SC-200 Certification Practice Question #33

Question

You have a Microsoft 365 E5 subscription that uses Microsoft Defender 365.

Your network contains an on-premises Active Directory Domain Services (AD DS) domain that syncs with Azure AD.

You need to identify LDAP requests by AD DS users to enumerate AD DS objects.

How should you complete the KQL query? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Accepted Answer

The task is to identify LDAP requests by AD DS users that enumerate AD DS objects. MS Learn defines IdentityQueryEvents as the table for "queries performed against Active Directory objects, such as users, groups, devices, and domains" — i.e. exactly the LDAP enumeration activity required — and it exposes the AccountSid column used in the filter. For the predicate, the requirement is simply to keep rows where AccountSid is populated, so `isnotempty(AccountSid)` is the correct scalar function; `has` and `contains` are string-match operators that require a search term to compare against, which the question does not supply. The Highly Voted comment (14 👍), a lab-tested comment (a311), and a corroborating explanation (hovlund) all align, and MS Learn confirms the table semantics. Confidence is 89 rather than higher only because there is no official Suggested Answer and one low-vote dissent (`has`), which is well refuted.

More SC-200 practice questions