SC-200 Certification Practice Question #126

Question

You have a Microsoft Sentinel workspace.

You develop a custom Advanced Security Information Model (ASIM) parser named Parser1 that produces a schema named Schema1.

You need to validate Schema1.

How should you complete the command? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Accepted Answer

To validate an ASIM parser's output schema, Microsoft Learn documents the exact command ` | getschema | invoke ASimSchemaTester('')`. `getschema` returns the parser's column/type metadata as a table, and `invoke` runs the stored function `ASimSchemaTester` against that piped table. Substituting the question's names yields `Parser1 | getschema | invoke ASimSchemaTester('Schema1')`, so dropdown 1 is `getschema` and dropdown 2 is `invoke`. The community ("Answer is correct," 26-👍 confirmation, and Murtuza's verbatim syntax) agrees, and the only ambiguity (which link ACSC pasted) does not affect the answer.

More SC-200 practice questions