Describe the capabilities of Microsoft security solutions →hardMultiple ChoiceObjective-mapped

SC-900 Practice Question: Describe the capabilities of Microsoft security solutions

Exhibit

Refer to the exhibit.

```kusto
DeviceAlertEvents
| where Timestamp > ago(7d)
| where AlertSeverity == "High"
| summarize Count = dcount(DeviceName) by AlertTitle
| top 10 by Count
```

Refer to the exhibit. You run a Kusto query in Microsoft Defender XDR Advanced Hunting. What does this query return?

⚠ Common exam trap

Candidates often confuse 'distinct devices' with 'total alerts' or 'devices with the most alerts', and overlook the explicit severity filter, leading them to choose options that ignore the high-severity filter or misidentify the aggregation column.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Top 10 high-severity alert titles by number of distinct affected devices

The query filters for high-severity alerts, then summarizes by AlertTitle and counts distinct DeviceName values. It orders by that count descending and takes the top 10, so it returns the top 10 high-severity alert titles ranked by the number of distinct affected devices.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Top 10 high-severity alert titles by number of distinct affected devices
Why this is correct
This option accurately describes a Kusto query that would use `where AlertSeverity == 'High'` to filter, then `summarize DistinctDevices = dcount(DeviceName) by AlertTitle`, and finally `top 10 by DistinctDevices desc` to achieve the stated goal. The use of `dcount(DeviceName)` correctly calculates the number of unique devices affected by each alert title, directly matching the 'distinct affected devices' requirement. Grouping by `AlertTitle` ensures the ranking is based on alert types, providing the top 10 most impactful alert titles.
✗
Top 10 alert titles by number of distinct devices, including all severities
Why it's wrong here
This option is incorrect because the typical Kusto query for this scenario would include a `where AlertSeverity == 'High'` clause, explicitly filtering for high-severity alerts only. This filter contradicts the option's claim of 'including all severities,' as the query's scope is intentionally narrowed to a specific severity level. Therefore, the results would not encompass alerts of medium, low, or informational severities.
✗
Top 10 devices with the most high-severity alerts
Why it's wrong here
This option is incorrect because a query designed to find the 'Top 10 devices' would require the `summarize` operator to group results `by DeviceName`, not `by AlertTitle`. Grouping by `AlertTitle` instead means the aggregation is counting occurrences or distinct devices *per alert type*, not aggregating the total impact or alerts *per individual device*. Consequently, the output would list alert titles, not device names, as the primary ranked entities.
✗
Top 10 high-severity alert titles by total number of alerts
Why it's wrong here
This option is incorrect because it specifies 'total number of alerts,' which would typically be calculated using the `count()` aggregation function. However, the correct query for 'distinct affected devices' utilizes `dcount(DeviceName)`, which counts only unique device entries. Using `dcount` instead of `count` means the query is measuring the breadth of impact (unique devices) rather than the sheer volume of alert instances, making this option an inaccurate description of the query's output.

Go deeper

SC-900 Practice Question: Describe the capabilities of Microsoft security solutions

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question