easyMultiple Choice
SC-200 Practice Question: A security analyst needs to create a custom…
A security analyst needs to create a custom watchlist in Microsoft Sentinel to correlate IP addresses known to be used by a threat actor. The watchlist will be uploaded from a CSV file. Which data type should the analyst specify for the watchlist alias?
⚠ Common exam trap
Test-takers frequently confuse the data type of the alias with the data type of the IP address values in the CSV, assuming IPs should be integers, but the alias is purely a metadata label and must be a string.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
String
The watchlist alias in Microsoft Sentinel is a string identifier used to reference the watchlist in KQL queries. Since IP addresses are stored as text values in CSV files and are not numeric integers, dates, or boolean flags, the correct data type for the alias is String. This ensures the alias can be used in join or lookup operations without type mismatch errors.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
String
Why this is correct
IP addresses are represented as strings because they are sequences of characters using dotted-decimal notation for IPv4 or hexadecimal and colons for IPv6. In Microsoft Sentinel watchlists, the String data type supports exact match, pattern matching, and CIDR range comparisons when used with KQL functions like ipv4_is_in_range. Unlike numeric types, String preserves the original formatting, including leading zeros and subnet masks, which is essential for accurate network security matching.
- ✗
Integer
Why it's wrong here
An Integer data type stores only whole numbers and cannot represent the dotted-decimal notation of an IPv4 address or the colon-delimited hexadecimal format of IPv6. Converting an IP address to an integer would strip away the delimiters, lose subnet information, and make it impossible to use standard security analytics functions that expect string-based IP representations. Additionally, integer types in watchlists do not support the colon characters required for IPv6, causing ingestion errors.
- ✗
DateTime
Why it's wrong here
The DateTime data type is designed exclusively for time-based values such as timestamps, event times, or log generation times. An IP address has no temporal meaning and cannot be parsed as a date or time; attempting to store it as DateTime would either fail during ingestion or produce meaningless default values. Watchlist columns used for joins and lookups on IP addresses must be text-based to align with how KQL parses network identifiers from other logs.
- ✗
Boolean
Why it's wrong here
The Boolean data type only supports two possible states: true or false, which is insufficient for storing a network address that can have billions of possible values. IP addresses serve as unique identifiers for hosts and cannot be reduced to a binary condition. Unlike fields like 'is malicious' or 'is internal', an IP address column requires a flexible, unrestricted data type to hold the actual address string for correlation with threat intelligence feeds.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SC-200 question from scratch — 1,303 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.