Questions

The best way to learn KQL is to practice it, hands-on, in the Microsoft 365 Defender portal. But, you can also test yourself with these questions:

1. True or false? You should practice actively hunting in your environment, rather than relying on automation, to stay ahead of emerging threats that may not have their own detection yet:
   1. True
   2. False
2. Which is this chapter’s recommended join flavor in advanced hunting?
   1. rightsemi
   2. leftsemi
   3. innerunique
   4. fullout
3. How many days back in time can you perform advanced hunting queries?
   1. 90 days
   2. 30 days
   3. 120 days
   4. 180 days
4. Which of the following two options can advanced hunting data be categorized into?
   1. Entity data
   2. Cloud/on-prem data
   3. Automatic/manual data
   4. Event/activity data
5. Which of the following is not an option for how often custom queries can run?
   1. Continuous
   2. Every 24 hours
   3. Every 48 hours
   4. Every 12 hours