SC-200 Practice Question 3850
Exam: SC-200
Domain: Perform threat hunting
Difficulty: hard
You are hunting for C2 beacons that communicate at exact periodic intervals (e.g., exactly every 60 seconds). Which KQL operator is designed to evaluate time-series trends and periodic intervals?
Answer Options
A
The `make-series` operator
B
The `distinct` operator
C
The `take` operator
D
The `project-away` operator
Correct Answer
A: The `make-series` operator
Explanation
The `make-series` operator creates time-series arrays aggregated over specified step intervals, enabling subsequent decomposition and periodicity functions.