SC-200 Practice Question 3841
Exam: SC-200
Domain: Perform threat hunting
Difficulty: medium
You want to write a KQL query that calculates the 95th percentile of process execution durations across a fleet of virtual machines. Which KQL aggregation function should you use inside `summarize`?
Answer Options
A
The `percentile(Duration, 95)` aggregation function
B
The `count()` function
C
The `dcount()` function
D
The `avg()` function
Correct Answer
A: The `percentile(Duration, 95)` aggregation function
Explanation
The `percentile(Duration, 95)` aggregation function calculates the value below which 95 percent of the observations in the dataset fall.