Microsoft Certified: Security Operations Analyst Associate Practice Mode

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• 1

  i confirm DeviceLogonEvents | where DeviceName in ("CFOLaptop" , "CEOLaptop" ) and ActionType == "LogonFailed" | summarize LogonFailures=count() by DeviceName , LogonType

• 1

  ChatGPT says : DeviceLogonEvents | where DeviceName in ("CFOLaptop", "CEOLaptop", "COOLaptop") | where LogonType == "Failed" | summarize FailedSignInCount = count() by DeviceName

• 4

  The correct answer is: DeviceLogonEvents | where DeviceName in ("CFOLaptop", "CEOLaptop", "COOLaptop") and ActionType == FailureReason |s summarize LogonFailures=count () by DeviceName, LogonType Here is a brief explanation of how this query works: The DeviceLogonEvents table is selected, which contains logon events for devices. The where clause filters the events to only include those that have a DeviceName of CFOLaptop, CEOLaptop, or COOLaptop, and an ActionType of FailureReason. This effectively filters the events to only include failed logon events from the specified devices. The summarize clause counts the number of events that match the previous criteria, grouping the results by DeviceName and LogonType. The count() function counts the number of events in each group, and the LogonFailures alias is used to label this count in the resulting output.