SC-200 Certification Practice Question #138

Question

You have a Microsoft Sentinel workspace named sws1.

You need to create a query that will detect when a user creates an unusually large numbers of Azure AD user accounts.

How should you complete the query? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Accepted Answer

The query detects a user creating an unusually large number of Azure AD accounts. Box 1 must expose `ActivityInsights` and `UsersInsights.AccountDisplayName` — columns that exist only in `BehaviorAnalytics` (the UEBA table), so Box 1 = BehaviorAnalytics. The second table is joined with `$right._ItemId`, then `mv-expand TargetResources` — and MS Learn confirms `TargetResources` is the `AuditLogs` column holding the changed resource (the created user). The `where ActionType == "Add user"` and `Core Directory/UserManagement/Add user` activity are AuditLogs/UEBA account-creation signals. Both Highly Voted comments (35 combined 👍) land on BehaviorAnalytics + AuditLogs, and the MS Learn schema for each column matches the query verbatim. Confidence is held to 80 because a sizable, hands-on minority insists the query only returns rows with BehaviorAnalytics in both boxes (since only BehaviorAnalytics carries `ActivityInsights`/`UsersInsights`); however, that reading ignores `mv-expand TargetResources`, which is an AuditLogs-only field, so the column-by-column schema evidence favors AuditLogs for Box 2.

More SC-200 practice questions