Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
Microsoft Certified: Security Operations Analyst Associate · Microsoft
Step Sequence / Reordering Question
Add and arrange the steps in the correct execution order.
Hotspot Solution:
I don't know man, It seems like the second table of options is a mistake/typo. you need "join (DeviceFileEvents | where Timestamp > ago(1h)) on SHA256" to appropriately select the relevant rows to apply the time filter on. seems outdated on the current Schema
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
Why the query looks for device file events? Is this relevant in this case?
EmailAttachmentInfo | where Timestamp > ago(1h) | where FileName == "Document.pdf" | join kind=inner (DeviceFileEvents | where Timestamp > ago(1h)) on SHA256
I don't know man, It seems like the second table of options is a mistake/typo. you need "join (DeviceFileEvents | where Timestamp > ago(1h)) on SHA256" to appropriately select the relevant rows to apply the time filter on. seems outdated on the current Schema