You need to complete the query for failed sign-ins to meet the technical requirements.
Where can you find the column name to complete the where clause?
Correct Answer: D
This is a case study. Case studies are not timed separately. You can use as much exam time as you would like to complete each case. However, there may be additional case studies and sections on this exam. You must manage your time to ensure that you are able to complete all questions included on this exam in the time provided.
To answer the questions included in a case study, you will need to reference information that is provided in the case study. Case studies might contain exhibits and other resources that provide more information about the scenario that is described in the case study. Each question is independent of the other questions in this case study.
At the end of this case study, a review screen will appear. This screen allows you to review your answers and to make changes before you move to the next section of the exam. After you begin a new section, you cannot return to this section.
To start the case study
To display the first question in this case study, click the Next button. Use the buttons in the left pane to explore the content of the case study before you answer the questions. Clicking these buttons displays information such as business requirements, existing environment, and problem statements. If the case study has an All Information tab, note that the information displayed is identical to the information displayed on the subsequent tabs. When you are ready to answer a question, click the Question button to return to the question.
Overview
Litware Inc. is a renewable company.
Litware has offices in Boston and Seattle. Litware also has remote users located across the United States. To access Litware resources, including cloud resources, the remote users establish a VPN connection to either office.
Recent Comments (The most recent comments are at the top.)
D is correct. By increasing the time window, we would know if the failed sign ins are common or suspecious.
The corrected code would be something like:
BehaviorAnalytics
| where ActivityType == "FailedLogOn"
| extend ActivityInsightsArray=parse_json(ActivityInsights)
| extend UnusualFailedSignIns = tostring(parse_json(ActivityInsightsArray).UnusualNumberOfFailedSignInOfThisUser)
| where UnusualFailedSignIns == True
| summarize count() by SourceIPLocation, UserName
| order by count_ desc