SC-200 Certification Practice Question #144

Question

You have a Microsoft Sentinel workspace.

You need to configure a report visual for a custom workbook. The solution must meet the following requirements:
•	The count and usage trend of AppDisplayName must be included.
•	The TrendList column must be useable in a sparkline visual.

How should you complete the KQL query? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Accepted Answer

The query computes per-app counts with `summarize`, then must merge that with a second subquery keyed on AppDisplayName — the `... on AppDisplayName` syntax on the surrounding line is the `join` operator's join condition, so Dropdown 1 is **join**. The second subquery builds `TrendList = count() on TimeGenerated in range(start, end, 4h) by AppDisplayName`; MS Learn confirms `make-series` is the operator that creates a series of aggregated values along a time axis, returning a numeric array per group that a sparkline visual can render — so Dropdown 2 is **make-series**. The community is unanimous (multiple `≥2 👍` comments, no dissent), and the surrounding `on AppDisplayName ... | top 10 by count_desc` syntax mechanically confirms join. Confidence 90, slightly below the ceiling only because the file carries no explicit official answer key.

More SC-200 practice questions