SC-200 Certification Practice Question #125

Question

You have a Microsoft 365 E5 subscription that contains two users named User1 and User2.

You have the hunting query shown in the following exhibit.

The users perform the following actions:

• User1 assigns User2 the Global administrator role. 
• User1 creates a new user named User3 and assigns the user a Microsoft Teams license. 
• User2 creates a new user named User4 and assigns the user the Security reader role. 
• User2 creates a new user named User5 and assigns the user the Security operator role.

For each of the following statements, select Yes if the statement is true. Otherwise, select No.

NOTE: Each correct selection is worth one point.

Accepted Answer

The query joins "Add user" events (AuditLogs, keyed on the created user as `TargetResources[0].userPrincipalName`) with "Create role assignment" events (AzureActivity, keyed on `Caller`). Statement 1 (role assignment of User2) has no matching user-creation, and statement 2 (User3) is a Teams *license* not a role — both are clearly No. Statement 3 hinges on interpretation: the dominant community answer (estyj 21 👍 Highly Voted, DChilds 6 👍, plus the intended key) reads the query as "new user creation that is then matched to a role assignment" and treats `project-away user1` as merely dropping the duplicate join column (confirmed by MS Learn), yielding Yes for User5. **Confidence is held at 72% because of a strong, technically literal NNN dissent** (danb67, user636, Max_DeJaV, danlo): strictly, AuditLogs `user` is the *target* of the creation while AzureActivity `user` is the *Caller* of the assignment, so under the default `innerunique` join no created user equals a caller and the result set is empty (NNN). MS Learn confirms the literal join/project-away mechanics but the question is written to the looser intended reading, so NNY is reported as the keyed answer with the conflict documented.

More SC-200 practice questions