Describe the core capabilities of the finance and operations apps →mediumMultiple ChoiceObjective-mapped

MB-920 Practice Question: Describe the core capabilities of the finance and operations apps

Exhibit

Refer to the exhibit.

```kusto
// KQL query for Dynamics 365 Finance - Audit log analysis
AuditLogs
| where TimeGenerated > ago(7d)
| where OperationName == "VendorInvoicePost"
| summarize Count = count() by UserPrincipalName
| top 5 by Count desc
```

Refer to the exhibit. An auditor runs this Kusto query in Microsoft Sentinel connected to Dynamics 365 Finance. What is the purpose of this query?

⚠ Common exam trap

Many candidates confuse the count of successful postings (event ID 1050) with failed postings or system account activity, leading them to select options B or C instead of recognizing the query's focus on top users by posting volume.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Find the top 5 users who posted the most vendor invoices in the past week

The Kusto query filters audit log entries for vendor invoice posting events (event ID 1050) from the past 7 days, groups them by user, counts the number of postings per user, and sorts descending to show the top 5 users. This directly identifies the users who posted the most vendor invoices in the past week, making option D correct.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Compare invoice posting rates between current and previous week
Why it's wrong here
The query only looks at the past 7 days.
✗
List all vendor invoices posted by system accounts
Why it's wrong here
The query does not filter by system accounts.
✗
Identify users who have failed to post vendor invoices
Why it's wrong here
The query does not filter by failure.
✓
Find the top 5 users who posted the most vendor invoices in the past week
Why this is correct
The query counts VendorInvoicePost operations per user and returns top 5.

Go deeper

MB-920 Practice Question: Describe the core capabilities of the finance and operations apps

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question