SC-200 · Question #304
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might…
The correct answer is B. No. Parsing an AuditData column from a 10,000-row CSV file in Microsoft Excel's Get & Transform Data operations will likely fail to generate specific columns if the AuditData column contains complex, nested JSON data without a consistent schema or proper JSON parsing configuration.
Question
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure subscription that uses Microsoft Defender XDR. From the Microsoft Defender portal, you perform an audit search and export the results as a file named File1.csv that contains 10,000 rows. You use Microsoft Excel to perform Get & Transform Data operations to parse the AuditData column from File1.csv. The operations fail to generate columns for specific JSON properties. You need to ensure that Excel generates columns for the specific JSON properties in the audit search results. Solution: From Defender, you modify the search criteria of the audit search to increase the number of returned records, and then you export the results. From Excel, you perform the Get & Transform Data operations by using the new export. Does this meet the requirement?
Options
- AYes
- BNo
How the community answered
(62 responses)- A19% (12)
- B81% (50)
Why each option
Parsing an AuditData column from a 10,000-row CSV file in Microsoft Excel's Get & Transform Data operations will likely fail to generate specific columns if the AuditData column contains complex, nested JSON data without a consistent schema or proper JSON parsing configuration.
This is incorrect because Excel's Get & Transform, while powerful, has limitations when dealing with highly complex, inconsistent, or deeply nested JSON structures within a single text column, especially if the parsing steps aren't precisely configured for the specific JSON schema.
The "AuditData" column in audit logs often contains complex, nested JSON objects. While Excel's Get & Transform (Power Query) can parse JSON, it requires that the JSON structure within the column is consistent and that the correct parsing steps (e.g., "Parse JSON," "Expand Column") are applied. If the operations fail to generate columns for "specific details," it suggests either an inconsistent JSON structure across rows, invalid JSON, or that the necessary steps to parse and expand the nested JSON elements were not correctly applied or could not handle the complexity automatically.
Concept tested: Excel Power Query limitations with complex JSON parsing
Source: https://support.microsoft.com/en-us/office/import-data-from-json-sources-power-query-a3465e9b-c40d-4566-a6e5-da733364f31c
Community Discussion
No community discussion yet for this question.