SC-200 Practice Question 3823
Exam: SC-200
Domain: Perform threat hunting
Difficulty: easy
You are writing a KQL hunting query in Microsoft Sentinel. You need to group sign-in failures by user account, count the occurrences, and filter for accounts with more than 20 failures in the last 1 hour. Which operator combination achieves this?
Answer Options
A
`SigninLogs | where TimeGenerated > ago(1h) and ResultType != "0" | summarize FailureCount = count() by UserPrincipalName | where FailureCount > 20`
B
`SELECT * FROM SigninLogs WHERE Failures > 20`
C
`SigninLogs | delete where Failures > 20`
D
`SigninLogs | summarize by count()`
Correct Answer
A: `SigninLogs | where TimeGenerated > ago(1h) and ResultType != "0" | summarize FailureCount = count() by UserPrincipalName | where FailureCount > 20`
Explanation
`SigninLogs | where TimeGenerated > ago(1h) and ResultType != "0" | summarize FailureCount = count() by UserPrincipalName | where FailureCount > 20` calculates the grouped occurrences.