mediumMultiple ChoiceObjective-mapped
SC-200 Practice Question: A SOC analyst is creating a scheduled analytics…
A SOC analyst is creating a scheduled analytics rule in Microsoft Sentinel to detect potential account compromise. The rule should trigger when a user account is created in Microsoft Entra ID and, within one hour, that same account is used to sign in from an unfamiliar location. The queries use the AuditLogs table for account creation and the SigninLogs table for sign-ins. Which KQL operator should be used to correlate these two events from different tables within a specific time window?
⚠ Common exam trap
It's easy for candidates to confuse union (which stacks rows) with join (which correlates rows), especially when the question mentions 'different tables' and 'time window' — union cannot enforce a time-based relationship between rows from separate tables.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
join
(join) because the scenario requires correlating two events from different tables (AuditLogs and SigninLogs) based on a common field (e.g., UserPrincipalName) and within a specific time window (one hour). The join operator in KQL allows you to combine rows from two tables by matching keys, and you can use the 'where' clause on the time fields to enforce the one-hour window. This is the only operator that supports row-wise correlation across tables with a time constraint.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
where
Why it's wrong here
The `where` operator filters rows in a single input table based on a predicate expression, such as `TimeGenerated > ago(1d)`. It cannot reference columns from another table unless that table has already been joined, nor can it bring in account creation and sign-in events for comparison. Filtering alone never correlates or merges separate data sources, so using `where` would not enable the analysis.
- ✓
join
Why this is correct
The `join` operator is the correct choice because it merges columns from two tables into a single row when a common key matches, such as joining `SecurityEvent` (account creation) to `SigninLogs` on `AccountName`. Using a `kind` like `innerjoin` and optionally comparing timestamps within a `where` clause allows the analyst to detect accounts that were created and then immediately signed in, directly correlating the two event streams. This row-level merge is exactly what the analytics rule needs.
- ✗
union
Why it's wrong here
The `union` operator stacks rows from multiple tables vertically, returning a single result set that contains all records from each input. It requires that both tables share a similar schema, but it does not align or correlate individual records; an account-creation row and a sign-in row remain separate rows with no relationship. Consequently, `union` cannot reveal whether a sign-in follows an account creation, making it unsuitable for this rule.
- ✗
summarize
Why it's wrong here
The `summarize` operator aggregates rows within a single table by grouping on a key and calculating aggregates like `count()` or `max()`. It cannot ingest a second table, so it has no way to bring in account-creation data separately from sign-in data. Even if you first joined the tables, `summarize` would only produce a summary—not preserve the row-level detail needed to flag a newly created account that signs in.
Go deeper
Related to this question
About these practice questions
This SC-200 question is part of Courseiva's 209-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.