Manage and maintain devices →mediumMultiple ChoiceObjective-mapped

MD-102 Manage and maintain devices Practice Question

Exhibit

{
  "exhibit": "KQL query in Microsoft Sentinel: DeviceInfo | where TimeGenerated > ago(7d) | where OSPlatform == 'Windows' | summarize TotalDevices = dcount(DeviceId) by DeviceName"}

Refer to the exhibit. You run this KQL query in Microsoft Sentinel. What is the result?

⚠ Common exam trap

The trap here is that candidates may misinterpret `dcount(DeviceName)` as a count of rows or a list of devices, rather than recognizing it as a distinct count aggregation, and may overlook that `DeviceInfo` is an inventory table, not an alert table.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

A count of unique Windows devices per device name in the last 7 days.

The KQL query uses `DeviceInfo` (a Microsoft Sentinel table for device inventory), filters with `where` to include only rows where `OperatingSystem` contains 'Windows', then uses `summarize` with `dcount(DeviceName)` to count distinct device names, and `bin(TimeGenerated, 7d)` to group by 7-day intervals. This produces a count of unique Windows devices per device name over the last 7 days, making option C correct.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
A list of all devices regardless of operating system.
Why it's wrong here
Incorrect. The query filters for Windows.
✗
A list of all Windows devices with their last activity.
Why it's wrong here
Incorrect. The query does not return last activity.
✓
A count of unique Windows devices per device name in the last 7 days.
Why this is correct
Correct. The query summarizes unique devices by name.
✗
A count of security alerts per device.
Why it's wrong here
Incorrect. The query uses DeviceInfo, not alert data.

Go deeper

MD-102 Manage and maintain devices Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question