SC-200 Practice Question: A SOC analyst is investigating a potential…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  SecurityEvent | where EventID == 4625 | summarize Count = count() by Account | where TimeGenerated > ago(1h)

  Why it's wrong here

  This query filters events by EventID 4625, then summarizes the count by account, and only then attempts to apply a time filter. Because the summarize operator discards the TimeGenerated column, the subsequent where clause references a column that no longer exists, causing a query error rather than returning 'incorrect' results. Even if the column were available, the filter would be applied after the aggregation, meaning events older than one hour would still be included in the counts. The correct approach is to apply the time filter before the summarize so only recent failed logons are counted.

• ✓

  SecurityEvent | where EventID == 4625 and TimeGenerated > ago(1h) | summarize Count = count() by Account

  Why this is correct

  This query correctly applies the time filter alongside the EventID filter in the where clause, so only failed logon events (Event 4625) from the last hour are passed into the summarize operator. The summarize then groups these pre-filtered rows by Account, yielding the failure count for each account within the desired time window. This is a textbook example of proper KQL query ordering: filter first, aggregate second, and optionally post-filter aggregated results only if needed.

• ✗

  SigninLogs | where ResultType != 0 | summarize Count = count() by UserPrincipalName | where TimeGenerated > ago(1h)

  Why it's wrong here

  This query uses the SigninLogs table, which contains Microsoft Entra ID authentication logs, not Windows Security Events captured by the SecurityEvent table. Event 4625 is specific to Windows, so any query against SigninLogs with ResultType != 0 will never return the failed logon attempts for a local VM. Additionally, the time filter is again placed after summarize, which is invalid because TimeGenerated is not retained after aggregation. To answer the question, the analyst must query SecurityEvent with EventID 4625 and apply the time filter before the summarize.

• ✗

  SecurityEvent | where EventID == 4625 | make-series Count = count() default=0 on TimeGenerated from ago(1h) to now() step 1h by Account

  Why it's wrong here

  The make-series operator is intended for creating time series data, generating a row per account with an array of counts for each time bucket, often used for line charts. Here, the requirement is simply the total number of failed logons per account, not a per-hour series; the query would return a collection of arrays rather than a flat summary table. While the query does filter by EventID and time, the output shape is wrong and the operator adds unnecessary complexity and overhead. A simple summarize count() by Account with the appropriate where clause is the clear and direct solution.

Go deeper

Related to this question