Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
Microsoft Certified: Security Operations Analyst Associate · Microsoft
Step Sequence / Reordering Question
Add and arrange the steps in the correct execution order.
Hotspot Solution:
DeviceID it has to be because DeviceId is available in both tables, CveId is not so that wouldn't work. 2nd is correct also because to create a custom detection rule you need DeviceID and ReportId in the output. And the question isn't asking for a count so summarise would not be correct.
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
part1: |distinct DeviceID Because DeviceID is required to successfully join the tables and distinct to limit the returns to unique devices part2: |project Timestamp, DeviceID, ReportID Your need Timestamp, DeviceID and ReportID in the return to create a custom detection rule https://learn.microsoft.com/en-us/microsoft-365/security/defender/custom-detection-rules?view=o365-worldwide#required-columns-in-the-query-results
Question says limit duplicates ?
correct