Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
Question 7 of 125
Free Preview · 125 of 415 · questions 1–125 of 415 are free. Sign up free to sync your progress across devices.
Hot Area / Sentence Completion
Select the appropriate option to complete the statement. Click Check Answer below to see the marked solution.
Hotspot Solution:
The query posted on MS docs doesnt actually work (I have tested in a live tenant) - it needs to be amended to match the below before it returns results (note the requirement to add DeviceName, and DeviceId fields to the first project statement). EmailAttachmentInfo | where SenderFromAddress =~ " [email protected] " | where isnotempty(SHA256) | join ( DeviceFileEvents | project FileName, SHA256, DeviceName, DeviceId ) on SHA256 | project Timestamp, FileName , SHA256, DeviceName, DeviceId, NetworkMessageId, SenderFromAddress, RecipientEmailAddress But if you choose the following from the answers presented in the question you will get the results you need to answer the question: EmailAttachmentInfo | where SenderFromAddress =~ " [email protected] " | where isnotempty(SHA256) | join ( DeviceFileEvents | extend FileName, SHA256 ) on SHA256 | project Timestamp, FileName, SHA256, DeviceName, DeviceId, NetworkMessageId, SenderFromAddress, RecipientEmailAddress ie Choose, Join, Extend, Project from the drop downs This has also been tested on live tenants and returns the correct result.
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
Join , project, project
The EmailAttachmentInfo table is selected, which contains information about email attachments. The where clause filters the attachments to only include those that were sent from the address " [email protected] " and have a non-empty SHA256 hash value. This effectively filters the results to only include attachments from the specified sender and that have a known hash value. The join operator combines the results of the previous step with the results of a second query that selects the DeviceFileEvent table and projects the FileName and SHA256 fields. This effectively creates a join between the two tables based on the SHA256 field, linking the attachments with file events on devices. The project operator selects the desired fields from the joined results and includes them in the final output.
EmailAttachmentInfo | where SenderFromAddress =~ " [email protected] " //Get emails with attachments identified by a SHA-256 | where isnotempty(SHA256) | join ( //Check devices for any activity involving the attachments DeviceFileEvents | project FileName, SHA256, DeviceName, DeviceId ) on SHA256 | project Timestamp, FileName , SHA256, DeviceName, DeviceId, NetworkMessageId, SenderFromAddress, RecipientEmailAddress