Deploy and manage a Microsoft 365 tenant →mediumMultiple ChoiceObjective-mapped

MS-102 Deploy and manage a Microsoft 365 tenant Practice Question

Exhibit

Refer to the exhibit.

```kql
DeviceLogonEvents
| where Timestamp > ago(7d)
| where AccountName == "admin"
| project Timestamp, DeviceName, AccountName, IPAddress
| order by Timestamp desc
```

Refer to the exhibit. An administrator runs the KQL query in Microsoft Defender for Endpoint. The result set is empty. What is the most likely reason?

⚠ Common exam trap

Many candidates assume an empty result set always indicates a configuration or onboarding problem, rather than recognizing that the query's specific filter (account name and time range) simply returned no matching data.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

No logon events with the account name 'admin' exist in the past 7 days.

The KQL query filters for logon events where the AccountName equals 'admin' (lowercase). If no such events occurred in the last 7 days, the result set will be empty. This is the most likely reason because the query explicitly restricts the time range and account name, and an empty result does not indicate a broader issue with onboarding or case sensitivity.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The device is not onboarded to Microsoft Defender for Endpoint.
Why it's wrong here
This is incorrect because the query is not scoped to a single device; it would return rows for any onboarded device that matches the AccountName filter. If a device were not onboarded to Microsoft Defender for Endpoint, it would simply not contribute data to the Advanced Hunting tables, but the presence of other onboarded devices would still produce results if they had matching logon events. Moreover, if the query were specifically targeting an unresponsive device, the query would need a DeviceName filter to isolate it. Therefore, the empty result set cannot be attributed to a single device's onboarding status.
✗
The query is case-sensitive and the account name is 'Admin' with a capital A.
Why it's wrong here
KQL's '==' operator is case-sensitive, so if the actual account name were 'Admin' with a capital A, the filter would indeed exclude those events. However, the query is explicitly searching for the exact string 'admin', and the correct interpretation of an empty result is that no logon events with that exact account name exist in the given time window. While case sensitivity could theoretically cause a false negative, it is not the most probable reason unless there is evidence that an 'Admin' account is active. The default assumption for an empty set should be that the data simply does not match the query criteria.
✓
No logon events with the account name 'admin' exist in the past 7 days.
Why this is correct
This is correct because the KQL query filters logon events by AccountName == 'admin' and a time range of the last 7 days. When the query executes, it scans the events table and returns only rows where the account name matches exactly and the timestamp falls within the period. An empty result set directly indicates that no logon events with the account name 'admin' occurred in those 7 days. It does not imply that no logon events happened at all, only that none matched the specified account and time filter.
✗
There are no logon events in the last 7 days.
Why it's wrong here
This is incorrect because the query includes a specific filter on AccountName, so the absence of results only tells us that no events matched that filter, not that the entire events table is empty. In fact, logon events from other accounts would be excluded by the filter and would not appear in the output. Additionally, on an active device or environment, logon events are abundant, so a complete absence of logon events over 7 days would be highly unusual and would require a separate investigation. The correct conclusion is limited to the account 'admin', not all logon activity.

Go deeper

MS-102 Deploy and manage a Microsoft 365 tenant Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question