SC-200 Certification Practice Question #130

Question

You have a Microsoft Sentinel workspace named SW1.

You plan to create a custom workbook that will include a time chart.

You need to create a query that will identify the number of security alerts per day for each provider.

How should you complete the query? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Accepted Answer

The requirement is "number of security alerts per day for each provider" plotted on a time chart. Grouping per day requires bucketing the `TimeGenerated` datetime, and the canonical KQL idiom — confirmed by MS Learn and the donathon comment — is `bin(TimeGenerated, 1d)` inside the `summarize ... by ProviderName, bin(TimeGenerated, 1d)`. The other options in that dropdown (`series_add`, `series_fill_linear`, `take`) don't aggregate raw rows into daily buckets. To draw a time chart, KQL requires the `render` operator with the `timechart` visualization (MS Learn: timechart "can only be used in the context of the render operator"); `materialize` and `project` do not visualize. The community consensus (ACSC 20 👍, donathon 4 👍) matches this exactly.

More SC-200 practice questions