Exam-Answer

Home / Microsoft / AZ-300 / Question 25

Prev Question
Next Question

Question 25

You monitor security events collected from virtual machines (VMs) hosted on Azure.

You prepare a static table that consists of the security event codes. You need to show the description of the event and how many times it occurred on the VM. If an event code is not present, zero should be displayed.

Select correct placeholder values.

Recuirement: Join to use to match data from the events with static table: Query option: PLACEHOLDER 1

Recuirement: Function to use to count the number of events: Query option: PLACEHOLDER 2

Answers


Advertisement

Explanation (click to expand)

You should use a Leftouter join to match data from the events with the static table. For this type of join, all records in the left table and matching records in the right table are included in the results. Unmatched output properties contain nulls.

You should not use the Innerunique join type to match data from the events with the static table. This is the default join mode. The values of the matched column on the left table are found, and duplicate values are removed. Then, the set of unique values is matched against the right table.

You should not use the Leftanti join type to match data from the events with the static table. Records from the left side that do not have matches on the right side are included in the results. The results table has only columns from the left table.

You should use the Count aggregation function. This function returns a count of the security events.

You should not use the DCount aggregation function to count the number of security events. The DCount function is used to calculate the distinct count values and remove duplicates from the dataset. In this case, you would observe only one event per VM.

You should not use the DCountIf aggregation function to count the number of security events. The DCountIf function is used to calculate the distinct count values and remove duplicates from the dataset. In this case, you would observe only one event per VM.

References (click to expand)

Prev Question
Next Question

Load more