mediumMultiple ChoiceObjective-mapped
SC-200 Practice Question: summarize groups rows based on specified columns.
A SOC analyst is creating a scheduled analytics rule in Microsoft Sentinel to detect brute-force attacks on Microsoft Entra ID. The rule should generate an incident when a single user account fails to authenticate more than 10 times in 5 minutes from the same IP address. Which KQL operator is most appropriate to aggregate the count of failed sign-ins?
⚠ Common exam trap
Microsoft often tests the distinction between row-level operators (`extend`, `project`, `where`) and aggregation operators (`summarize`, `make-series`), and the trap here is that candidates mistakenly choose `where` thinking it can count events by filtering for a threshold, but `where` only filters rows and cannot aggregate across multiple rows to produce a count.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
summarize
The `summarize` operator is the correct choice because it aggregates data into groups based on specified criteria, such as counting the number of failed sign-ins per user and IP address within a time window. In this scenario, you need to count events where `ResultType` indicates failure (e.g., 50053 or 50057), grouped by `UserPrincipalName` and `IPAddress`, and then filter for counts exceeding 10. The `summarize` operator with `count()` directly provides this aggregation, enabling the rule to trigger an incident when the threshold is met.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
summarize
Why this is correct
summarize is the KQL aggregation operator that groups rows by specified columns, such as UserPrincipalName or IPAddress, and computes aggregates like count(), sum(), or avg() across each group. In a scheduled analytics rule, this is exactly what enables threshold detection by producing per-entity event counts that can be compared against a threshold, such as more than 5 failed sign-ins for a single user.
- ✗
extend
Why it's wrong here
extend adds new calculated columns to each existing row without grouping or reducing the number of rows. Because it performs row-wise transformations, such as adding a computed field like TotalBytes = Bytes * 2, it cannot aggregate multiple events into per-entity totals, making it impossible to evaluate a detection threshold across a time window.
- ✗
project
Why it's wrong here
project selects a subset of columns from the input table, similar to a SQL SELECT clause, and can optionally rename or compute columns, but it preserves the row count. Since it does not collapse multiple rows into groups or perform any kind of aggregation, it cannot produce the counts needed to evaluate a threshold condition like 'more than 5 events from one IP address.'
- ✗
where
Why it's wrong here
where filters the input set by applying a boolean condition to each row, retaining only matching rows, analogous to a WHERE clause in SQL. It reduces the number of rows but does not group them or calculate counts, so while it can be used to narrow down events before aggregation, on its own it cannot satisfy the requirement to summarize data for threshold comparison.
Go deeper
Related to this question
About these practice questions
One of 209 original SC-200 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.