SC-200 Certification Practice Question #32

Question

You have a Microsoft 365 E5 subscription that uses Microsoft Defender 365.

Your network contains an on-premises Active Directory Domain Services (AD DS) domain that syncs with Azure AD.

You need to identify the 100 most recent sign-in attempts recorded on devices and AD DS domain controllers.

How should you complete the KQL query? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Accepted Answer

The goal is the 100 most recent sign-in attempts from devices (DeviceLogonEvents) AND domain controllers. Devices are covered by DeviceLogonEvents; the on-premises AD DS domain-controller sign-ins live in IdentityLogonEvents, which MS Learn defines as "Authentication events on Active Directory and Microsoft online services" and which carries the AccountUpn/AccountSid columns referenced in the project-reorder line. To merge the two independent 100-row result sets you concatenate them with `union`, not a keyed `join`, since there is no matching key — you simply want all rows from both tables. The Highly Voted comment (13 👍) and multiple corroborating comments agree on IdentityLogonEvents + union. Confidence is held at 88 (not higher) because the question's printed KQL syntax is acknowledged by several commenters to be jumbled and there is no official Suggested Answer, though the two dropdown selections themselves are not in dispute.

More SC-200 practice questions