SC-200 Certification Practice Question #28

Question

You have a Microsoft 365 E5 subscription.

You need to create a hunting query that will return every email that contains an attachment named Document.pdf. The query must meet the following requirements:

•	Only show emails sent during the last hour.
•	Optimize query performance.

How should you complete the query? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Accepted Answer

Microsoft's own "Advanced hunting query best practices" article reproduces this exact query as its example for optimizing the `join` operator, applying `Timestamp > ago(1h)` to *both* tables. That fixes Box 1 as the left-table time filter (`| where Timestamp > ago(1h)`, applied early to reduce records per the "apply filters early" guidance) and Box 2 as the `kind=inner` join that carries the same `Timestamp > ago(1h)` on the `DeviceFileEvents` (right) side — satisfying both the "last hour" requirement and "optimize query performance." `ago(1h)` subtracts one hour from now, so records *newer* than that point satisfy `Timestamp > ago(1h)`; the `< ago(1h)` dissent inverts the window and Microsoft's query optimizer even flags it. Confidence is held at 88 (not higher) because there is no answer image and a vocal minority pushed `< ago(1h)`, but MS Learn settles it unambiguously.

More SC-200 practice questions