mediumMultiple ChoiceObjective-mapped
SC-200 Practice Question: A SOC analyst is creating a Microsoft Sentinel…
A SOC analyst is creating a Microsoft Sentinel scheduled analytics rule to detect failed sign-in attempts from a specific list of known malicious IP addresses. The IP addresses are stored in a CSV file that is updated weekly. The analyst uploads the file as a new table in the Log Analytics workspace. Which KQL operator should the analyst use to reference this table within the rule's query?
⚠ Common exam trap
Candidates often confuse the 'externaldata()' operator (used for ad-hoc queries on external files) with the direct table reference for already-ingested custom logs, or assume that any uploaded CSV becomes a watchlist, when in fact watchlists require explicit creation and are accessed via a dedicated function.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use the custom table name directly in the query, e.g., 'MaliciousIPs_CL'.
When a CSV file is uploaded as a new table in the Log Analytics workspace, it becomes a custom table with a '_CL' suffix (e.g., 'MaliciousIPs_CL'). The analyst can then reference this table directly in the KQL query, just like any other table in the workspace. This is the standard method for using custom log data ingested via the Log Analytics agent or direct upload.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use the custom table name directly in the query, e.g., 'MaliciousIPs_CL'.
Why this is correct
When a CSV file is uploaded as a new custom table in a Microsoft Sentinel Log Analytics workspace, it is assigned a name with the '_CL' suffix and stored as a regular KQL table. You can directly reference that table name, e.g., 'MaliciousIPs_CL', in a scheduled query just like any other table, because the data is already ingested and available for Kusto to scan. This is the standard and most efficient way to query custom log data, as no additional functions, operators, or external references are required.
- ✗
Use 'externaldata()' to point to the CSV file in Azure Blob storage.
Why it's wrong here
The `externaldata()` operator is incorrect because the scenario specifies the analyst "uploads the file as a new table in the Log Analytics workspace," meaning the data is already ingested and available as a standard KQL table. `externaldata()` is designed to query data directly from external sources like Azure Blob storage *without prior ingestion* into Log Analytics. It is tempting because it handles external CSV files, and would be the correct choice if the requirement was to query the CSV file directly from Blob storage without creating a Log Analytics table.
- ✗
Use 'union' with the workspace name to include the CSV data.
Why it's wrong here
The union operator is designed to combine rows from two or more tables into a single result set, but it does not provide a mechanism to incorporate CSV data that is already stored as a custom table. Since the data has been uploaded as 'MaliciousIPs_CL', it is already accessible by its table name, and adding a workspace name via union is unnecessary and syntactically incorrect for referencing a table's contents. Furthermore, union would only be relevant if you needed to merge this table with another table, not to simply query it on its own.
- ✗
Use 'watchlist' function, because CSV files are automatically treated as watchlists.
Why it's wrong here
Uploading a CSV as a custom table does not automatically make it a Sentinel watchlist; watchlists are a distinct feature that stores key-value pairs and are specifically designed for use with the _GetWatchlist() function in KQL. To use a CSV as a watchlist, you must explicitly create a watchlist resource in Sentinel and import the CSV into that resource, not just upload it as a custom log table. Therefore, invoking the watchlist function against a custom table would fail or return no results, making this option incorrect for querying the uploaded CSV data.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SC-200 question from scratch — 209 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.