easyMultiple ChoiceObjective-mapped
SC-200 Practice Question: A security analyst needs to identify incidents in…
A security analyst needs to identify incidents in Microsoft Sentinel that are related to IP addresses known to be associated with a specific threat actor. The analyst has a CSV file containing a list of these IP addresses. Which feature should the analyst use to make this list available for queries in Sentinel?
⚠ Common exam trap
Many exam-takers confuse Threat Intelligence indicators with a simple CSV import, but TI indicators require a structured format and integration with a TI platform, whereas a Watchlist is the direct, low-friction solution for static reference data.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Watchlist
A Watchlist in Microsoft Sentinel allows you to import a CSV file containing IP addresses and use it directly in KQL queries via the _GetWatchlist() function. This is the correct feature because it is specifically designed for storing and querying static reference data, such as known threat actor IPs, without requiring custom ingestion or transformation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Custom Log
Why it's wrong here
A Custom Log ingests raw data into a Log Analytics workspace but does not create a searchable, persistent reference table that can be joined to threat-intelligence indicators in Microsoft Sentinel. It is tempting because it can store the CSV’s IP addresses as log entries, and in scenarios requiring ad-hoc analysis of non-standard data sources (e.g., application logs), a Custom Log would be the correct ingestion method. However, for reusable lookups against Sentinel incidents, the analyst needs a Threat Intelligence indicator feed or a watchlist, not a Custom Log.
- ✓
Watchlist
Why this is correct
In Microsoft Sentinel, a watchlist is a metadata-stored, queryable table that lets you upload a CSV of IP addresses and reference it in KQL via _GetWatchlist(), allowing you to match incident entities or enrich analytics rules without redeploying detections. Watchlists support aliases, search keys, validity dates, and are natively integrated into Alert Rules and hunting, making them the simplest and most appropriate mechanism for a custom IP list that must be joined against incoming events. Unlike raw data ingestion, watchlist data is retained in a structured reference table optimized for lookups.
- ✗
Threat Intelligence indicator
Why it's wrong here
Threat intelligence indicators in Sentinel are ingested as STIX objects via connectors such as TAXII, Microsoft Defender Threat Intelligence, or an API, and land in the ThreatIntelligenceIndicator table for use with analytics rule templates like 'TI Map IP to Events'. They are not designed for ad-hoc uploads of an arbitrary CSV file; while an automation script could parse the CSV into STIX and post it via the TI API, this requires a separate application and does not provide the same direct one-click UI or schema flexibility as a watchlist. For a simple custom IP list, a watchlist is the intended primitive; forcing it into TI indicators introduces unnecessary format and licensing overhead.
- ✗
Bookmark
Why it's wrong here
A bookmark in Microsoft Sentinel is an investigation feature that saves a snapshot of a specific table row or query result for a specific hunt, linking to entities and allowing later annotation and export to an incident, but it is not a data structure that can be reused as a lookup table inside analytics or hunting queries. Bookmarked rows are stored in the Bookmark table with metadata, not as raw IPs available for KQL joins, and bookmark references do not participate in scheduled incident-generation rules. Thus, while a bookmark can capture evidence of a list, it cannot serve as the IP source to drive detection logic.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SC-200 question from scratch — 209 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.