mediumMultiple ChoiceObjective-mapped
SC-200 Practice Question: A SOC analyst needs to create a scheduled…
A SOC analyst needs to create a scheduled analytics rule in Microsoft Sentinel that detects when a user logs in from an IP address that is not in a predefined list of known corporate IP ranges. The list is maintained as a custom Sentinel watchlist and frequently updated. Which KQL function should the analyst use to reference the watchlist within the rule's query?
⚠ Common exam trap
Candidates often confuse _GetWatchlist() with externaldata() or lookup(), thinking they can achieve the same result, but only _GetWatchlist() is designed for Sentinel watchlists and integrates seamlessly with analytics rules.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
_GetWatchlist()
The _GetWatchlist() function is the correct KQL function to reference a custom Sentinel watchlist within an analytics rule query. It retrieves the watchlist content as a table, allowing the analyst to join or filter login events against the known corporate IP ranges. This function is specifically designed for Sentinel watchlists and supports frequent updates without modifying the rule query.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
externaldata()
Why it's wrong here
externaldata() is a KQL operator that reads data from external files, such as those in Azure Blob Storage or Azure Data Lake, by specifying a URI and file format. Sentinel watchlists are stored as internal artifacts within the Log Analytics workspace, not as external blobs, so this operator cannot access them. Additionally, externaldata() would require a publicly accessible URI and a user-defined schema, making it unsuitable for retrieving watchlist data used in analytics rules.
- ✓
_GetWatchlist()
Why this is correct
_GetWatchlist() is the correct, built-in KQL function specifically designed to return the content of a Microsoft Sentinel watchlist by name. For example, _GetWatchlist('IPSAllowlist') returns a table with the watchlist's columns and rows, which you can then join with or filter against other data in the analytics rule query. This function is the native mechanism for operationalizing watchlists in scheduled rules and is preferred over generic operators because it handles the internal watchlist schema automatically.
- ✗
lookup()
Why it's wrong here
lookup() is a general-purpose KQL operator that joins two tables by extending the left table with columns from the right table for matching rows, akin to a left outer join on match keys. While it can be used to combine a watchlist-derived table with telemetry, it does not itself retrieve the watchlist content; you would first need to call _GetWatchlist() to obtain that data. Therefore, using lookup() alone in a query will not access Sentinel watchlists, making it an incorrect response.
- ✗
invoke()
Why it's wrong here
invoke() is a KQL operator that applies a tabular expression, typically a user-defined function or plugin, to the input table, effectively augmenting or transforming the query pipeline. It is not intended for fetching data stored in Sentinel watchlists; it has no awareness of watchlists as a data source. Using invoke() to retrieve watchlist content would require pre-loading watchlist data via a different mechanism, so this option does not solve the requirement.
Go deeper
Related to this question
About these practice questions
One of 209 original SC-200 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.