Example exam questions
- You are hunting in the Microsoft 365 Defender (M365 Defender) portal and writing a query but need to narrow down the results. Which two lines of code should be added to give a quick sample of 10 from the last 30 days?
a. | where Timestamp > ago(30d)
b. | join Timestamp > ago(30d)
c. | limit 10 by Timestamp > ago(30d)
d. | limit 10
- If you're hunting in Sentinel and come across results you want to use later, what would you use to save them for later?
a. Notebook
b. Livestream
c. Bookmark
d. Analytics rule
- Which operator would you use to show only specific columns in your Kusto results?
a. select
b. project
c. take
d. limit
- You're reading an analyst report for one of the latest campaigns in the wild. In it, you learn about some behaviors that you can hunt for. What could you use to have that searched for on a cadence to then alert you?
a. Custom indicator
...
