Exam SC-200 topic 1 question 38 discussion

now I'm not so sure... on the page given by mwoodc the answer provided is shown as : *Apply time filters on both sides* — Even if you're not investigating a specific time window, applying time filters on both the left and right tables can reduce the number of records to check and improve join performance. The query below applies Timestamp > ago(1h) to both tables so that it joins only records *from* the past hour: EmailAttachmentInfo | where Timestamp > ago(1h) | where Subject == "Document Attachment" and FileName == "Document.pdf" | join kind=inner (DeviceFileEvents | where Timestamp > ago(1h)) on SHA256 if you ask bing chat/chatGPT, this is what the query retrieves This KQL query will retrieve information about the email attachments with the subject “Document Attachment” and the file name “Document.pdf” that were sent within the last hour. It will then join this information with the DeviceFileEvents table on the SHA256 hash value which is what the question is asking for...

Wrong. This will search for logs from an hour ago till infinity in the past (until your specified time range). Even plugging this into KQL logs for a test run will throw an error on the statement with a recommendation to change it from < to > Recommendation: The query time filter may not be efficient. The TimeGenerated filter is looking for smaller than rather than larger than. This may result in querying high volume of very old data that is retained in the system. It is recommended to add a minimum TimeGenerated to be evaluated or to specify a time range to this query (see: https://aka.ms/logqueryperf/time).