mediumMultiple ChoiceObjective-mapped
SC-200 Practice Question: A SOC analyst creates a watchlist in Microsoft…
A SOC analyst creates a watchlist in Microsoft Sentinel from a CSV file containing IP ranges (10.0.0.0/16) and a tag. The analyst wants to use this watchlist in a KQL query to check if a sign-in IP is within the ranges. Which KQL function should be used?
⚠ Common exam trap
Candidates often confuse string-matching operators (has, contains, in) with IP-specific functions, failing to recognize that CIDR range evaluation requires a dedicated function like `ipv4_is_in_range`.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
_GetWatchlist('name') and use the ipv4_is_in_range function with the watchlist as a parameter
The `ipv4_is_in_range` function is designed to check whether an IPv4 address falls within a specified CIDR range. When combined with `_GetWatchlist('name')`, you can iterate over the watchlist entries and use `ipv4_is_in_range` to compare the sign-in IP against each range. This is the only approach that correctly handles CIDR notation (e.g., 10.0.0.0/16) rather than performing string matching or exact value comparison.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
_GetWatchlist('name') and use the has operator
Why it's wrong here
The KQL `has` operator is a string search that looks for a whole term within a field, not a subnet evaluation. An IP address and a CIDR watchlist entry such as `10.0.0.0/16` are different textual representations, so `has` cannot determine whether an address is inside the network boundary. It may produce false positives only when the exact range text appears inside the string, and it will miss every valid IP in the range.
- ✗
_GetWatchlist('name') and use the in operator
Why it's wrong here
The `in` operator performs exact equality matching against a set of scalar values, so each sign-in IP must equal one of the watchlist entries literally. Because a watchlist range is stored as a CIDR string like `192.168.10.0/24`, it will never equal a single host IP such as `192.168.10.55`, leaving all ranged addresses unmatched. This approach is only useful if the watchlist contains a finite list of explicit IPs, not CIDR ranges.
- ✓
_GetWatchlist('name') and use the ipv4_is_in_range function with the watchlist as a parameter
Why this is correct
The `ipv4_is_in_range` function is the correct KQL scalar function for this scenario because it parses its first argument as an IPv4 address and the second as a CIDR range, returning a boolean representing membership. Using `_GetWatchlist('name')` provides the table of range strings, and you join or filter so each watchlist range is passed as the second parameter against the sign-in IP column. For IPv6 subnets, `ipv6_is_in_range` offers the same capability, making this a network-aware approach rather than a text-based match.
- ✗
_GetWatchlist('name') and use the contains operator
Why it's wrong here
The `contains` operator is a case-insensitive substring search, meaning it evaluates at character level instead of octet level. A watchlist value like `10.20.30.0/24` will only match if that exact character sequence appears within the IP field, which practically never happens for normal IP addresses and certainly not as a range test. Conversely, it can generate false positives when a short watchlist string such as `10.1` appears as a substring of a larger IP like `10.10.1.5`.
Visual reference
Go deeper
Related to this question
About these practice questions
This SC-200 question is part of Courseiva's 209-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.