SC-200 Mitigate threats using Microsoft Sentinel Practice Question
This SC-200 practice question tests your understanding of mitigate threats using microsoft sentinel. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. A key principle to apply: the `lookup` operator enriches query results with data from a watchlist.. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A security analyst wants to create a custom detection rule in Microsoft Sentinel that alerts when a user logs in from an IP address that is not in the company's approved IP range. The analyst has an existing watchlist named 'ApprovedIPs' containing the allowed ranges. Which KQL operator should the analyst use to compare the IP address from the SigninLogs table against the watchlist?
Why wrong: While 'join' can merge tables, it is not the recommended operator for watchlist enrichment. 'lookup' is optimized for this purpose and is more efficient.
B
lookup
Correct. The 'lookup' operator seamlessly enriches query results with data from a watchlist, making it ideal for comparing IP addresses against known approved ranges.
C
evaluate
Why wrong: 'evaluate' is used to invoke specific KQL plugins (e.g., machine learning models) and does not perform watchlist matching.
D
where
Why wrong: 'where' filters rows based on conditions but cannot directly reference external watchlist data. You would need to use 'lookup' first to enrich the data.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
lookup
The `lookup` operator is the correct choice because it is specifically designed to enrich or filter data in one table based on a dimension table (like a watchlist) without requiring a full merge of columns. In this scenario, the analyst needs to compare IP addresses from the SigninLogs table against the ApprovedIPs watchlist to find logins from non-approved ranges, and `lookup` performs this efficiently by matching on a key field (the IP address) and returning only rows that do not have a match in the watchlist when used with a `kind=leftanti` parameter.
Key principle: The `lookup` operator enriches query results with data from a watchlist.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
join
Why it's wrong here
While 'join' can merge tables, it is not the recommended operator for watchlist enrichment. 'lookup' is optimized for this purpose and is more efficient.
✓
lookup
Why this is correct
Correct. The 'lookup' operator seamlessly enriches query results with data from a watchlist, making it ideal for comparing IP addresses against known approved ranges.
Related concept
The `lookup` operator enriches query results with data from a watchlist.
✗
evaluate
Why it's wrong here
'evaluate' is used to invoke specific KQL plugins (e.g., machine learning models) and does not perform watchlist matching.
✗
where
Why it's wrong here
'where' filters rows based on conditions but cannot directly reference external watchlist data. You would need to use 'lookup' first to enrich the data.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates often confuse `lookup` with `join` because both can combine data from two sources, but `lookup` is the correct operator for watchlist-based enrichment in Microsoft Sentinel, while `join` is overkill and less efficient for this specific use case.
Detailed technical explanation
How to think about this question
Under the hood, the `lookup` operator in Kusto Query Language (KQL) performs a left outer join but only projects columns from the right (dimension) table into the left (fact) table, making it ideal for watchlist enrichment. A subtle behavior is that `lookup` by default returns all rows from the left table, but when combined with `kind=leftanti`, it returns only rows from the left table that have no match in the right table—perfect for detecting IPs not in the approved range. In a real-world scenario, if the ApprovedIPs watchlist contains CIDR ranges (e.g., 10.0.0.0/8), the analyst would need to use the `ipv4_is_in_range()` function within the `lookup` condition to handle subnet matching, as a direct equality match would fail.
KKey Concepts to Remember
The `lookup` operator enriches query results with data from a watchlist.
`lookup` is optimized for performance when joining with smaller, static reference data.
Watchlists in Sentinel are ideal for storing lists of approved or blocked entities like IP addresses.
After `lookup`, a `where` clause can filter for matches or non-matches against the watchlist data.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
The `lookup` operator enriches query results with data from a watchlist.
Real-world example
How this comes up in practice
A cloud solutions architect for a retail company is evaluating services for a new workload. The correct answer here reflects best practice for the specific scenario described — not a general cloud recommendation. The `lookup` operator enriches query results with data from a watchlist. Cloud exam questions reward reading the constraint carefully: the same technology can be right or wrong depending on the use case.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this SC-200 question in full detail.
Review the `lookup` operator enriches query results with data from a watchlist., then practise related SC-200 questions on the same topic to reinforce the concept.
Mitigate threats using Microsoft Sentinel — This question tests Mitigate threats using Microsoft Sentinel — The `lookup` operator enriches query results with data from a watchlist..
What is the correct answer to this question?
The correct answer is: lookup — The `lookup` operator is the correct choice because it is specifically designed to enrich or filter data in one table based on a dimension table (like a watchlist) without requiring a full merge of columns. In this scenario, the analyst needs to compare IP addresses from the SigninLogs table against the ApprovedIPs watchlist to find logins from non-approved ranges, and `lookup` performs this efficiently by matching on a key field (the IP address) and returning only rows that do not have a match in the watchlist when used with a `kind=leftanti` parameter.
What should I do if I get this SC-200 question wrong?
Review the `lookup` operator enriches query results with data from a watchlist., then practise related SC-200 questions on the same topic to reinforce the concept.
What is the key concept behind this question?
The `lookup` operator enriches query results with data from a watchlist.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.