SC-200 Certification Practice Question #1

Question

You are investigating an incident by using Microsoft 365 Defender.
You need to create an advanced hunting query to count failed sign-in authentications on three devices named CFOLaptop, CEOLaptop, and COOLaptop.
How should you complete the query? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Select and Place:

Accepted Answer

The task is to count failed sign-ins on three named devices. `DeviceLogonEvents` is the only schema table holding device authentication events (MS Learn: "Sign-ins and other authentication events on devices"), so it is the source table. The device list is filtered with `where DeviceName in (...)`, and failed logons are isolated with `ActionType == "LogonFailed"`. MS Learn's own advanced-hunting best-practices article uses this exact pattern, and the community (142 👍 tested answer plus an 8-👍 schema verification showing `distinct ActionType` yields only `LogonSuccess`/`LogonFailed`/`LogonAttempted`) confirms `FailureReason` is a column, never an ActionType value — so the leaked `ActionType == FailureReason` option returns zero rows and is wrong. Confidence is held at 90 rather than higher because no official Suggested Answer is recorded in the file and the exact slot count must be inferred from the image, though the resolved query is unambiguous.

More SC-200 practice questions