SC-200 Certification Practice Question #35

Question

51 HOTSPOT

You have a custom detection rule that includes the following KQL query.

For each of the following statements, select Yes if True. Otherwise, select No.

NOTE: Each correct selection is worth one point.

Accepted Answer

The KQL query's output columns decide each statement. MS Learn is explicit that email actions require BOTH `NetworkMessageId` and `RecipientEmailAddress`; the query summarizes away `NetworkMessageId`, so Row 1 is firmly No. Row 2 is firmly Yes because `DeviceId` is projected and Restrict app execution is a supported device action. Row 3 hinges on whether the Quarantine file action (the mechanism for SHA256) counts as "deletion": MS Learn says it "deletes the file from its current location and places a copy in quarantine," which the 29-👍 top comment and three supporting commenters read as Yes. A minority of lab testers report the file action as inactive/No for their environment, which is why confidence sits in the HOTSPOT band rather than higher — Rows 1 and 2 are certain, Row 3 carries the only real ambiguity, resolved as Yes per the literal MS Learn wording and the strongest community signal.

More SC-200 practice questions