SC-200 Certification Practice Question #119

Question

You have a Microsoft Sentinel workspace named sws1.
You need to create a hunting query to identify users that list storage keys of multiple Azure Storage accounts. The solution must exclude users that list storage keys for a single storage account.
How should you complete the query? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:

Accepted Answer

The query detects users who list storage keys across multiple accounts by joining Azure Activity operations and then clustering callers whose caller IP differs from their expected IP. The outer and inner table must be AzureActivity (the only source with the `microsoft.storage/storageaccounts/listkeys/action` operation and `CallerIpAddress`), and the inner `join` block explicitly re-queries AzureActivity, making Row 1 unambiguous. For Row 2, only the `autocluster()` plugin is invoked via `evaluate` and finds common patterns across discrete attributes — exactly what's needed to surface anomalous multi-account listing — whereas bin() and count() are not evaluate plugins for this purpose. Two Highly Voted comments and the official Microsoft Sentinel GitHub hunting query corroborate. Confidence is 90 (not higher) only because the dump has no formal Suggested/Most Voted tally, though the community and MS Learn agree.

More SC-200 practice questions