A correlation rule is created to detect potential insider threats by correlating user login events from one dataset with file access events from another dataset. The rule must retain all user login…

Question

Options

• AInner
• BLeft
• CRight
• DOuter

• A
  3% (2)
• B
  78% (46)
• C
  14% (8)
• D
  5% (3)

Explanation

Option B (Left join) is correct because a left join returns all records from the left dataset (x) regardless of whether a match exists in the right dataset (y). In this insider threat scenario, every login event must be preserved - even if the user never accessed a file - since an absence of file activity is itself meaningful intelligence.

Why the others are wrong:

• A. Inner - only returns rows where matches exist in both datasets, which would silently drop login events with no corresponding file access, creating dangerous blind spots.
• C. Right - retains all records from the right dataset (y, file access events), which is the opposite of what's needed; login events without file matches would be lost.
• D. Outer (Full outer) - retains all records from both datasets, which over-includes data and could surface file access events with no associated login (a different use case entirely).

Memory tip: Think of the join name as pointing to which "side" you want to protect. Left join = protect the left dataset (x). The dataset written before the join keyword is always the "left" - so dataset = x | join (dataset = y) means x is left, and a left join keeps all of x intact.

No community discussion yet for this question.