Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
Microsoft Certified: Security Operations Analyst Associate · Microsoft
Hot Area / Sentence Completion
Select the appropriate option to complete the statement. Click Check Answer below to see the marked solution.
Hotspot Solution:
The answer is correct. Here is an example: //Define new table for malicious emails let MaliciousEmails=EmailEvents //List emails detected as malware, getting only pertinent columns | where ThreatTypes has "Malware" | project TimeEmail = Timestamp, Subject, SenderFromAddress, AccountName = tostring(split(RecipientEmailAddress, "@")[0]); MaliciousEmails | join ( //Merge malicious emails with logon events to find logons by recipients IdentityLogonEvents | project LogonTime = Timestamp, AccountName, DeviceName ) on AccountName //Check only logons within 30 minutes of receipt of an email | where (LogonTime - TimeEmail) between (0min.. 30min) | take 10
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
First dropdown: EmailEvents This table contains MalwareFilterVerdict, RecipientEmailAddress, Subject, SenderFromAddress, etc. So this identifies the known malicious emails. Second dropdown: IdentityLogonEvents This table contains sign-in/logon information such as AccountName, Timestamp, and DeviceName. Third dropdown: top 20 The requirement is to return the most recent 20 sign-ins.
The prompt specifically asks for the "most recent" 20 sign-ins. So "top 20" sorts the data by the timestamp (latest logons first) and grabs the exact 20 newest records. "Take 20" is random / unordered. If you run the query three times, you might get three different sets of 20 random records.
Why use take and not top in this scenario? The query in your case doesn't explicitly mention sorting the logon events by a specific column (e.g., timestamp). It simply limits the results to a certain number, so take is appropriate here. If you wanted the 20 most recent logon events, you could use top 20 by LogonTime, which ensures that you are retrieving the most recent events sorted by time.