SC-200 Certification Practice Question #262

Question

You need to create an advanced hunting query to investigate the executive team issue.
How should you complete the query? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:

Accepted Answer

The case-study scenario concerns file activity (data access, download, deletion) in **Microsoft Cloud App Security-protected applications** — a SaaS/cloud scope, not local disk. MS Learn confirms CloudAppEvents is the table for "events involving accounts and objects in Office 365 and other cloud apps and services" and that it inherited the deprecated AppFileEvents data, so the official Suggested Answer (CloudAppEvents) aligns with the scenario and the highest-voted comments (teehex 22 👍, AlaReAla 8 👍, madhatter 5 👍). For the aggregation, the requirement "files with more than five activities" counts rows, so **count()** is correct (avg/sum compute numeric values, not occurrence counts). Confidence is capped at 78% because there is a genuine, well-supported technical conflict: a strong dissenting bloc (ACSC 7 👍, wsrudmen, danb67) correctly notes that the literal `FolderPath`/`FileName` group-by columns shown in the query do not exist on CloudAppEvents (they live on DeviceFileEvents), so the printed query is technically inconsistent with the table the exam expects. Following Microsoft's intended/Suggested answer and the scenario wording, CloudAppEvents + count() is the keyed selection, but the column mismatch keeps this below the high band.

More SC-200 practice questions