Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
Microsoft Certified: Security Operations Analyst Associate · Microsoft
Hot Area / Sentence Completion
Select the appropriate option to complete the statement. Click Check Answer below to see the marked solution.
Hotspot Solution:
join & project Filtering the DeviceInfo table to only include rows where the LoggedOnUsers field contains the string "user1". Removing duplicates based on the DeviceId field. Joining the resulting set of devices with the AlertEvidence table based on the DeviceId field. Projecting the AlertId field from the resulting set. Joining the resulting set of alerts with the AlertInfo table based on the AlertId field. Projecting the AlertId, Timestamp, Title, Severity, and Category fields from the resulting set of alerts. This query retrieves a list of alerts that are related to devices where the user "user1" is logged on, and it includes the alert ID, timestamp, title, severity, and category for each alert. The "join" and "project" operations in the query are used to combine and filter the data from the various tables in the ATP data model.
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
Join project
correct
"join" and "project" are correct. https://learn.microsoft.com/en-us/microsoft-365/security/defender/advanced-hunting-query-emails-devices?view=o365-worldwide#get-device-information