Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
Microsoft Certified: Security Operations Analyst Associate · Microsoft
Hot Area / Sentence Completion
Select the appropriate option to complete the statement. Click Check Answer below to see the marked solution.
Hotspot Solution:
No, Yes, Yes. First Statement (No): To trigger automated email response actions (such as deleting an email), the query results must include both NetworkMessageId and RecipientEmailAddress. While RecipientEmailAddress is included in the final summarize statement, NetworkMessageId is missing from the projection. Second Statement (Yes): Device actions such as "Restrict app execution" require the presence of DeviceId and a unique identifier (ReportId). Both columns are properly projected in the final line of the KQL query. Third Statement (Yes): File containment actions (like "Quarantine file") require a file hash column (SHA256 or InitiatingProcessSHA256) along with DeviceId. Since both fields are successfully outputted by the final summarize operator, this action is supported.
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
No, Yes, Yes. First Statement (No): To trigger automated email response actions (such as deleting an email), the query results must include both NetworkMessageId and RecipientEmailAddress. While RecipientEmailAddress is included in the final summarize statement, NetworkMessageId is missing from the projection. Second Statement (Yes): Device actions such as "Restrict app execution" require the presence of DeviceId and a unique identifier (ReportId). Both columns are properly projected in the final line of the KQL query. Third Statement (Yes): File containment actions (like "Quarantine file") require a file hash column (SHA256 or InitiatingProcessSHA256) along with DeviceId. Since both fields are successfully outputted by the final summarize operator, this action is supported.
On Exam 25/06/2024
IdentityQueryEvents isnotempty