hardMultiple ChoiceObjective-mapped
SC-200 Practice Question: A SOC analyst in Microsoft Sentinel is creating a…
A SOC analyst in Microsoft Sentinel is creating a scheduled analytics rule to detect a possible password spray attack. The rule must trigger when a single source IP address has more than 10 failed logon attempts on different user accounts within a 30-minute window. The analyst writes a KQL query starting with 'SigninLogs | where ResultType == 50057' (failed logon). Which operator should the analyst use to group events by source IP and count distinct user accounts, then filter for counts above 10?
⚠ Common exam trap
Watch out — candidates often confuse `summarize` with `extend` or `project`, thinking they can achieve aggregation without an explicit grouping operator, or they mistakenly use `where` after a simple filter instead of performing the required count and threshold check.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
summarize
The `summarize` operator is required to group events by source IP address and count distinct user accounts using `dcount()` or `count()`. After summarizing, you apply a `where` clause to filter for counts above 10, which meets the rule's threshold. This is the standard pattern for aggregation in KQL.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
summarize
Why this is correct
The 'summarize' operator is the correct answer because it groups rows by specified columns and applies aggregation functions such as dcount() or count() to calculate distinct user counts per IP. It produces a new table with one row per group, enabling the SOC analyst to derive meaningful metrics like unique users per IP address. Without summarize, no grouping or aggregation can be performed in KQL.
- ✗
where
Why it's wrong here
The 'where' operator filters rows based on a predicate, returning only the subset of rows that satisfy the condition. It does not group rows or apply aggregation functions, so it cannot calculate distinct user counts per IP. While where is often used before summarize to narrow the dataset, it alone cannot produce the required aggregated result.
- ✗
extend
Why it's wrong here
The 'extend' operator appends new computed columns to each existing row, preserving the original number of rows in the result set. It does not perform any grouping or reduction, and it cannot calculate aggregated values like distinct counts across IP addresses. Its purpose is purely transformational, adding fields such as derived timestamps or normalized data, not summarizing.
- ✗
project
Why it's wrong here
The 'project' operator selects, renames, or reorders a specified set of columns from the input, effectively shaping the output schema. It does not group rows or compute aggregate functions, so it cannot calculate distinct user counts per IP. Project is used for column manipulation, not for data reduction or aggregation.
Go deeper
Related to this question
About these practice questions
One of 673 original SC-200 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.