SC-200 Certification Practice Question #230

Question

You have an Azure subscription name Sub1 that is linked to a Microsoft Entra tenant named contoso.com. Sub1 contains a Log Analytics workspace named Workspace1. All the logs from contoso.com are streamed to Workspace1.

You have a Microsoft 365 E5 subscription.

You need to query Workspace1 for the following:

•	HTTP requests to the Microsoft Graph service of contoso.com
•	Third-party app sign-in activities that use certificates or secrets

How should you complete the KQL query? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Accepted Answer

Third-party (non-Microsoft) applications authenticating with certificates or client secrets are service principals, so their sign-in activity lands in **AADServicePrincipalSignInLogs** — that is the table to union/join into MicrosoftGraphActivityLogs. The documented correlation between a Graph API call and its originating sign-in is `MicrosoftGraphActivityLogs.SignInActivityId` matched to the sign-in log's `UniqueTokenIdentifier`. MS Learn ships this exact join verbatim, and both top community comments reproduce it, so all signals converge.

More SC-200 practice questions