SC-200 Certification Practice Question #239

Question

You have a Microsoft 365 subscription.

You need to identify all the security principals that submitted requests to change or delete groups.

How should you complete the KQL query? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Accepted Answer

The query targets the `MicrosoftGraphActivityLogs` table, where the endpoint path lives in the `RequestUri` column (MS Learn sample queries use `RequestUri has "groups"`), so Row 1 must be RequestUri — Scopes and Type are unrelated columns. For Row 2, identifying principals that "change or delete" groups means excluding read-only calls: `RequestMethod != "GET"` returns every non-GET method (POST/PUT/PATCH/DELETE), which is exactly the set of mutating operations. The two highest-voted comments (8 👍 each) and OneplusOne all converge on RequestUri + "GET", and MS Learn's documented query patterns and column schema confirm both choices. Confidence is held at 88 (not higher) because the file records no official Suggested Answer and a couple of commenters initially wavered on the GET-vs-POST cell, though the exclusion logic resolves it clearly.

More SC-200 practice questions