SC-200 Certification Practice Question #253

Question

You have an Azure subscription named Sub1 that contains a Microsoft Sentinel workspace named WS1.

You need to create a hunting query in WS1 that meets the following requirements:

•	Returns the number of changes performed daily by each Microsoft Entra security principal during a seven-day period
•	Identifies all the successful changes to the resources in Sub1
•	Substitutes any missing data points with 0

How should you complete the KQL query? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Accepted Answer

The requirement is to count successful resource changes per Microsoft Entra security principal (Caller) across a seven-day daily window in Sub1, substituting missing data points with 0. The schema fields baked into the query — `OperationNameValue endswith "write"`, `ActivityStatusValue == "Succeeded"`, `EventSubmissionTimestamp`, `ResourceId`, `Caller` — are exactly the **AzureActivity** columns that record Azure Resource Manager control-plane operations, so the table dropdown is AzureActivity (AuditLogs is Entra audit data; AzureDiagnostics is diagnostic resource logs). The "substitute missing data points with 0" requirement combined with the explicit `default=0` and `in range(ago(7d), now(), 1d)` clause is the signature of the **make-series** operator, whose `default` parameter fills empty time bins with 0; neither `summarize` nor `mv-expand` produces a gap-filled regular time series. Community comments agree on AzureActivity + make-series; confidence is held at 88 rather than higher because examtopics recorded no formal Suggested/Most Voted tally and one comment proposed the wrong table.

More SC-200 practice questions