mediumMultiple ChoiceObjective-mapped
SC-200 Practice Question: A SOC analyst in Microsoft Sentinel is creating a…
A SOC analyst in Microsoft Sentinel is creating a scheduled analytics rule to detect sign-ins from IP addresses known to be associated with a threat actor. The list of threat actor IPs is maintained in a custom Microsoft Sentinel watchlist and is updated daily. The analyst wants the rule to query the SigninLogs table and compare the IP address against this list. What is the most efficient way to reference the list in the KQL query?
⚠ Common exam trap
Watch out — candidates often confuse `_GetWatchlist()` with other data retrieval methods like `externaldata` or `datatable`, not realizing that watchlists are a first-class Sentinel feature designed for exactly this use case—dynamic, centrally managed threat intelligence that updates automatically without query modification.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use the _GetWatchlist() function to retrieve the watchlist.
The `_GetWatchlist()` function is the built-in, optimized way to reference a Microsoft Sentinel watchlist within a KQL query. It retrieves the watchlist data directly from the Sentinel workspace, ensuring the query always uses the latest daily-updated list without manual maintenance or external dependencies. This approach is both efficient and aligns with Sentinel's intended design for dynamic threat intelligence.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use the externaldata operator to read from a blob storage URL.
Why it's wrong here
The externaldata operator pulls data from an external source like Azure Blob Storage at query runtime, introducing a reliance on storage availability and network latency. For a scheduled Sentinel rule that checks frequently changing reference data, this bypasses Sentinel's built-in watchlist caching, which can degrade performance and cause missed detections if the blob is unreachable. Additionally, managing SAS URLs or storage permissions adds operational overhead and potential credential leakage risk, making it a poor fit for automated alerting.
- ✗
Use the let statement to define a static list inline.
Why it's wrong here
Using a let statement to define an inline static list means the list is hard-coded directly in the rule's KQL. Any daily update to the reference data would require manually editing the analytics rule's query and saving it, which is error-prone and creates version control gaps. The rule cannot automatically reflect new entries until an analyst modifies and re-saves the query, so it is impractical for dynamic threat intelligence or changing IP/domain block lists.
- ✓
Use the _GetWatchlist() function to retrieve the watchlist.
Why this is correct
_GetWatchlist('name') is the purpose-built Kusto function for retrieving Microsoft Sentinel watchlist content inside an analytics rule. The watchlist data is cached by Sentinel, and updates made through the portal, API, or PowerShell are automatically reflected without changing the rule query. This centralization enables SOC teams to maintain and version reference data independently from detection logic, while still supporting efficient joins and lookups in scheduled queries, making it the recommended pattern.
- ✗
Use the datatable operator to define the list directly in the query.
Why it's wrong here
The datatable operator creates a static in-memory table within the query, similar to a let statement but with explicit column schema and row syntax. Because the data is embedded in the rule, any list modification requires rewriting the entire query, and large lists bloat the rule text, making it difficult to audit and maintain. Unlike watchlists, datatable does not offer update history, access controls, or centralized storage, so it is not suitable for operational reference data that changes over time.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SC-200 question from scratch — 209 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.