Microsoft Certified: Security Operations Analyst Associate Practice Mode

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• 1

  Given answers are correct

• 1

  Given answer is correct

• Chose AE6

  A = Requirement is to create an alert. Not B = This will hide the the alert. Not C = Avoid filtering custom detections using the Timestamp column. The data used for custom detections is pre-filtered based on the detection frequency. Not D = Random filler answer E = To create a custom detection rule, the query must return the following columns: ->Timestamp—used to set the timestamp for generated alerts ->ReportId—enables lookups for the original records One of the following columns that identify specific devices, users, or mailboxes: -> DeviceId