hardMultiple ChoiceObjective-mapped
SC-200 Practice Question: A SOC analyst wants to create a watchlist in…
A SOC analyst wants to create a watchlist in Microsoft Sentinel from a CSV file that contains IP addresses. The analyst needs to configure the watchlist so that it can be efficiently queried using IP address comparison operators (e.g., IP prefix matching). Which data type should be set for the key column?
⚠ Common exam trap
Watch out — candidates often assume 'string' is sufficient for all text-based data, overlooking that Microsoft Sentinel requires specific data types like 'ipaddress' to enable optimized IP comparison operators and avoid query performance degradation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
ipaddress
The 'ipaddress' data type is correct because it enables Microsoft Sentinel to parse and index the column values as IP addresses, allowing efficient use of IP-specific operators such as 'has_ip_prefix()' for prefix matching. Without this type, the watchlist would treat IPs as plain strings, preventing optimized IP comparison queries.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
ipaddress
Why this is correct
The `ipaddress` data type is the correct choice for a watchlist column intended to store IP addresses. In KQL, this type unlocks native IP functions like `ipv4_is_match` and `ipv4_compare`, which support efficient subnet matching and CIDR notation comparisons directly at query time. Unlike a plain string, `ipaddress` ensures the stored values are parsed and validated as IP addresses, enabling optimized indexing and precise range queries without requiring manual conversion or parsing in every query.
- ✗
string
Why it's wrong here
While a string data type is suitable for general text-based lookups, it does not support the specialised IP address comparison operators required for efficient prefix matching. This makes it unsuitable for the scenario where the watchlist needs to be queried using IP address ranges or CIDR notation. It is tempting because IP addresses are fundamentally text strings, and string is the default or most common data type for many watchlist entries, such as usernames or hostnames.
- ✗
dynamic
Why it's wrong here
The `dynamic` data type is intended for complex structures such as arrays, dictionaries, and JSON objects, not for a scalar value like a single IP address. While you could accidentally store an IP as a dynamic value, it would not expose any of the IP-specific comparison functions available on the `ipaddress` type, and any subnet or range evaluation would require cumbersome and error-prone manual parsing. Using `dynamic` here would also break the expected schema for a watchlist, since watchlists are meant to hold simple, queryable key-value pairs.
- ✗
guid
Why it's wrong here
The `guid` data type is designed exclusively for globally unique identifiers (UUIDs), which are 128-bit hexadecimal values used to identify entities like records or objects. An IP address, whether IPv4 or IPv6, does not conform to the GUID format and cannot be properly represented or compared using this type. Even if you forced an IP into a GUID field, Sentinel would not recognize it as an address, so you would lose the ability to perform any IP-aware matching or subnet calculations.
Go deeper
Related to this question
About these practice questions
One of 209 original SC-200 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.