SC-200 Certification Practice Question #117

Question

You need to create a query for a workbook. The query must meet the following requirements:
✑ List all incidents by incident number.
✑ Only include the most recent log for each incident.
How should you complete the query? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:

Accepted Answer

The requirement is one row per incident (group by IncidentNumber) keeping only the most recent log (max LastModifiedTime, with all columns). In KQL that is `summarize arg_max(LastModifiedTime, *) by IncidentNumber`: `summarize … by IncidentNumber` collapses to one row per incident, and `arg_max(LastModifiedTime, *)` returns the entire row holding the latest LastModifiedTime. Microsoft's own "Manage your SOC better with incident metrics" page gives this exact query for this exact scenario, and multiple tested, highly-voted comments confirm it. project, sort, limit, and top cannot satisfy the per-incident dedup-to-latest requirement, so the two dropdowns resolve unambiguously.

More SC-200 practice questions