SC-200 Certification Practice Question #41

Question

You have a Microsoft 365 subscription that uses Microsoft Purview and Microsoft Teams.

You have a team named Team1 that has a project named Project1.

You need to identify any Project1 files that were stored on the team site of Team1 between February 1, 2023, and February 10, 2023.

Which KQL query should you run?

Accepted Answer

The scenario explicitly scopes the tooling to "Microsoft Purview and Microsoft Teams," and asks to find files on a Team site within a fixed date range — that is a Purview Content Search, whose query language is Keyword Query Language (KeyQL), confusingly also abbreviated "KQL." MS Learn's condition-builder doc confirms `(c:c)` is the content-search condition marker and date filtering uses the `date=start..end` interval form, which is exactly option C's shape (`Project1(c:c)(date=2023-02-01..2023-02-10)`). Options B and D use Kusto `AuditLogs | where` pipe syntax that belongs to Advanced Hunting in M365 Defender, a workload the question never grants, and D's `ago(10d)` doesn't match the absolute Feb 1–10 window. Both the official Suggested Answer and the top community vote (13 👍, lab-tested) select C. Confidence is held at 80 because there is a substantial, well-argued B faction trading on the KQL/KeyQL naming ambiguity; MS Learn breaks the tie in favor of C since the data source is Purview, not Advanced Hunting.

More SC-200 practice questions