ExamTopics Logo
Mail Us[email protected]
Menu
Microsoft Discussions
exam questions

Exam SC-200 All Questions

View all questions & answers for the SC-200 exam
Go to Exam

Exam SC-200 topic 3 question 87 discussion

Actual exam question from Microsoft's SC-200
Question #: 87
Topic #: 3
[All SC-200 Questions]

HOTSPOT
-

You have a Microsoft Sentinel workspace.

You need to configure a report visual for a custom workbook. The solution must meet the following requirements:
• The count and usage trend of AppDisplayName must be included.
• The TrendList column must be useable in a sparkline visual.

How should you complete the KQL query? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Show Suggested Answer Hide Answer
Suggested Answer:
by Fez786 at Sept. 9, 2023, 7:05 a.m.

Comments

Chosen Answer:
This is a voting comment (?). It is better to Upvote an existing comment if you don't have anything to add.
Switch to a voting comment New
Submit Cancel
user636
8 months ago
Join & make-series are the correct answers
upvoted 2 times
...
smanzana
9 months ago
Join Make-series
upvoted 1 times
...
chepeerick
1 year, 6 months ago
Correct option
upvoted 1 times
...
danb67
1 year, 6 months ago
https://www.cloudsma.com/2021/04/kusto-make-series-vs-summarize/ correct
upvoted 1 times
...
sand5234
1 year, 6 months ago
Answer is correct More explanation here https://www.cloudsma.com/2021/04/kusto-make-series-vs-summarize/
upvoted 2 times
...
Anil0512
1 year, 7 months ago
He is right there, correct answers are - Join & make-series. Join is 100% correct; searched up for make-series it is to be correct too.
upvoted 2 times
...
Fez786
1 year, 7 months ago
This new question arrived today 9th september 2023. Can someone please verify the correct answer?
upvoted 1 times
...
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.

SaveCancel
exam
Someone Bought Contributor Access for:
SY0-701
London, 1 minute ago