Describe the capabilities of Microsoft compliance solutions →hardMultiple ChoiceObjective-mapped

SC-900 Practice Question: Describe the capabilities of Microsoft compliance solutions

Exhibit

Refer to the exhibit.

```kusto
AuditLogs
| where ActivityOperation == "FileUploaded"
| where TimeGenerated > ago(30d)
| where UserId == "user@contoso.com"
| summarize FileCount = count() by FileType
| where FileCount > 10
```

Refer to the exhibit. An administrator runs this KQL query in Microsoft Purview Audit. What is the purpose of this query?

⚠ Common exam trap

The trap here is that candidates may misread the query as counting total uploads (option A) or listing files (option C), but the `summarize by FileType` and `where Count > 10` clearly indicate aggregation by file type with a frequency threshold, not a simple list or total count.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

To identify file types that a specific user uploaded more than 10 times in the last 30 days

The KQL query uses `| summarize Count = count() by FileType` to group audit log entries by file type, then `| where Count > 10` filters for file types that appear more than 10 times. The `where UserId == 'user@domain.com'` restricts the results to a specific user, and `| where TimeGenerated > ago(30d)` limits the time range to the last 30 days. This directly identifies file types uploaded more than 10 times by that user, matching option D.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
To find the total number of file uploads by all users in the last 30 days
Why it's wrong here
This option is incorrect because the KQL query explicitly filters for actions performed by a *specific user*, not "all users." Furthermore, if the query groups by file type, it would provide counts per type rather than a single total number of uploads across all types for that user, let alone for all users. The `where InitiatingUser == "specific_user_id"` clause restricts the scope significantly.
✗
To find files larger than a certain size uploaded by a specific user
Why it's wrong here
This option is incorrect because the KQL query, as described by the correct answer's characteristics, does not include any filtering mechanism for file size. There is no `where FileSize > some_value` or similar clause present, which would be essential to identify files based on their size attribute. The query focuses on upload activity and file types, not file dimensions.
✗
To list all files deleted by a specific user in the last 30 days
Why it's wrong here
This option is incorrect because the KQL query specifically targets "file uploads," as indicated by the context provided by the correct answer. To list deleted files, the query would need to filter for an `ActivityType` or `OperationName` corresponding to file deletion events, such as `FileDeleted` or `DeleteFile`, which is not the operation being queried here.
✓
To identify file types that a specific user uploaded more than 10 times in the last 30 days
Why this is correct
This option accurately describes the KQL query's purpose. The query filters events for a *specific user* within the *last 30 days*, focusing exclusively on *file upload* activities. It then *groups these uploads by file type* and subsequently filters the results to display only those *file types that the user uploaded more than 10 times*, effectively identifying frequently uploaded file types by that individual.

Go deeper

SC-900 Practice Question: Describe the capabilities of Microsoft compliance solutions

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question