hardMultiple ChoiceObjective-mapped
How to Use _GetWatchlist to Filter Allowed IPs in KQL
A SOC analyst is creating a scheduled analytics rule in Microsoft Sentinel to detect sign-ins from IP addresses that are not in the organization's known allow list. The allow list is maintained in a custom watchlist named 'AllowedIPs'. The analyst wants the KQL query to efficiently filter out allowed IPs. Which KQL approach should the analyst use?
Quick Answer
The correct approach is to use the _GetWatchlist('AllowedIPs') function with the '!in' operator. This works because _GetWatchlist dynamically retrieves the watchlist content at query runtime, and the '!in' operator efficiently filters out any IP addresses that match entries in that list, avoiding hardcoded values or inefficient row-by-row comparisons. On the SC-200 exam, this scenario tests your understanding of how to leverage Microsoft Sentinel’s watchlist functions for dynamic threat detection, often appearing in analytics rule creation questions. A common trap is to use a static list or a subquery with 'where not in', which fails to update automatically when the watchlist changes. Remember the key: _GetWatchlist pulls the list live, and '!in' excludes matches—think of it as “get the list, then kick out the known good.”
⚠ Common exam trap
It's easy for candidates to confuse the 'lookup' operator with filtering, or assume a static 'let' statement is acceptable, failing to recognize that watchlists are designed for dynamic, centrally managed data that must be referenced at query runtime.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use the _GetWatchlist('AllowedIPs') function and filter with the '!in' operator.
The _GetWatchlist('AllowedIPs') function retrieves the watchlist content at query runtime, and combining it with the '!in' operator efficiently filters out sign-ins from IPs present in the watchlist. This approach is dynamic, meaning updates to the watchlist are automatically reflected without modifying the query, and it avoids hardcoding IPs or using inefficient row-by-row lookups.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use the 'lookup' operator to map IPs against the watchlist.
Why it's wrong here
The 'lookup' operator is used for enriching data with values from a table, not for filtering based on exclusion.
- ✗
Use a 'let' statement to define a static list of allowed IPs.
Why it's wrong here
A static list would require manual updates and is not scalable or dynamic like a watchlist.
- ✓
Use the _GetWatchlist('AllowedIPs') function and filter with the '!in' operator.
Why this is correct
The _GetWatchlist function retrieves the watchlist content, and the '!in' operator efficiently excludes matching IPs from the results.
- ✗
Use the 'evaluate' operator with a python script.
Why it's wrong here
The 'evaluate' operator is for machine learning or plugin functions, not for simple watchlist lookup.
Go deeper
Related to this question
About these practice questions
One of 209 original SC-200 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SC-200
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A SOC analyst wants to create a Microsoft Sentinel scheduled analytics rule that alerts when a user from a critical department (e.g., Finance) logs on from an IP address that is not in the company's approved IP address ranges. The analyst has an Azure Sentinel watchlist named 'FinanceApprovedIPs' containing the allowed IP ranges. Which KQL operator should be used in the rule's query to efficiently check if the IP address from SigninLogs falls within any of the watchlist ranges?
medium- ✓ A.join kind=inner (watchlist) on $left.IPAddress $right.IPRange with condition using ipv4_is_in_range() or ipv4_lookup()
- B.where IPAddress has any (watchlist)
- C.where IPAddress in (watchlist)
- D.where IPAddress startswith (watchlist)
Why A: The `ipv4_lookup()` function (or `ipv4_is_in_range()` used with a join) is specifically designed to efficiently check whether an IP address falls within a range defined in a watchlist. In Microsoft Sentinel, watchlists store data as tables, and `ipv4_lookup()` performs a range-based lookup using CIDR notation, which is far more efficient than string-based or exact-match operators. This allows the query to match the `IPAddress` from `SigninLogs` against the `IPRange` column in the `FinanceApprovedIPs` watchlist without iterating over every possible address.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.