SC-200 Exam - Question 173

Question

HOTSPOT-You have a Microsoft 365 E5 subscription that contains two users named User1 and User2. You have the hunting query shown in the following exhibit. The users perform the following actions:• User1 assigns User2 the Global administrator role. • User1 creates a new user named User3 and assigns the user a Microsoft Teams license. • User2 creates a new user named User4 and assigns the user the Security reader role. • User2 creates a new user named User5 and assigns the user the Security operator role. For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

Examice · Accepted Answer

.

estyj · Answer

NNY  Actions of User1 is project-away will be excluded from results. Only actions of user2 will be shown.
https://learn.microsoft.com/en-us/azure/data-explorer/kusto/query/projectawayoperator

ACSC · Answer

Answer is correct.

pupugaga · Answer

N/N/Y for me, theres project-away at the end so the first 2 are actioned by user 1 so not visible, and the last one is actioned by user 2 so therefore visible.

teouba · Answer

This query doesnt make any sense at all
In our example, the first part of the query checks for "Add User" operation and returns a table with a "User" column where the values will be User3, User4 and User5 since it looks for "TargetResources"
The second part of the query checks for "Role Assignment" operation and returns a table with a "User" column where the values will be User1, User1, User2, User2 since it looks for "Caller" (meaning the user who performed the role assignment)
So the values of the "User" column are totally different for these 2 tables, so JOIN should not return any result..

This query is wrong

herta · Answer

answer is correct

AuditLogs
| where OperationName == "Add user"
// show all newly created users, this part will identify creation of user 3 and user 5

assignment of user 2 by user 1 won't be display because of "project-away user1"

7c0a · Answer

join kind is not defined so its a default one - innerunique (All deduplicated rows from the left table that match rows from the right table)
https://learn.microsoft.com/en-us/azure/data-explorer/kusto/query/joinoperator?pivots=azuredataexplorer

N - no match in the first table AuditLogs
N - Adding license is not a Role assignment, no match in the second table - AzureActivity
Y - present in both tables, query returns result

donathon · Answer

NNY for me

chepeerick · Answer

No, No, Yes

DChilds · Answer

First part of the query looks for Add user events in Auditlogs, second part of the query looks for "Create role assignment' events in Azureactivity and third part joins both searches so both parts need to match for the final search result.

No - The query is intended to search for user creation events with role assignment, this does not match that.
No - Matches first part of the query but not the second. User is assigned a Microsoft Teams license which is not a role.
Yes - A new user is created and assigned the Security Operator role which matches both parts of the query.

Fcnet · Answer

not sure about the inpact of the project-away operator, if it is just view or impact result
https://learn.microsoft.com/en-us/azure/data-explorer/kusto/query/projectawayoperator

wsrudmen · Answer

Explanation of the request with this link

https://learn.microsoft.com/fr-fr/azure/sentinel/get-visibility

botesjuan · Answer

is MS teams license assignment to user3 going to be detected by this part of query?
 | where OperationName == “Create role assignment”

danb67 · Answer

Teouba is correct. I just recreated this scenario in a lab. This question is to test your knowledge of Join kinds imo. If you run this command with innerunique which is the default if no join kind is chosen then we do not get any results as different users are returned for each table. Innerunique will show us only results if we have duplicate rows from the left and the right table. In this case we don't. If we chose another Join kind then results will show. If the screenshot is correct then we assume its using innerunique and in that case the answer would be N N N

Frankie21 · Answer

Roles assignments are not registered in the Azureactivity table but in the auditing table.
Therefore 3 times no!!!

danb67 · Answer

In order for this to produce results then a user would have to appear in both tables as we are using innerunique(default join kind) Since the 1st part of the query is looking for target resource (the user that was created) and the 2nd part of the query is looking for caller (the user that did the action) Then the only time we would get a hit is if a user that had just been created then performed the add operation. Is this not what this query is looking for? To see if a new user account starts messing with roles/group membership? In this given example none of the newly created users then does and messes with group/roles so no hits here and I double down on N/N/N

chepeerick · Answer

Correct

jacobtriestech · Answer

The query will identify the role assignment of User2: No
The query will identify the creation of User3: Yes
The query will identify the creation of User5: Yes

SC-200 Exam - Question 173

Discussion