Courseiva
← SC-200
Full test
hardMultiple ChoiceObjective-mapped

SC-200 Practice Question: A SOC team uses Microsoft Sentinel with multiple…

A SOC team uses Microsoft Sentinel with multiple workspaces in a single region. They have deployed Azure Policy to send all Azure resource logs to a central Log Analytics workspace. Now they want to create a set of analytics rules that run across multiple workspaces to detect cross-workspace attacks. However, they note that the built-in analytics rules can only query data within the workspace they are defined. Which solution should the team implement to efficiently query data from multiple workspaces for detection?

⚠ Common exam trap

It's easy for candidates to confuse Azure Lighthouse's cross-tenant management delegation with cross-workspace querying, or assume that a central workspace automatically queries linked workspaces without explicit KQL expressions.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Create a KQL function that unions the relevant tables from all workspaces using the workspace() expression, then use that function in the analytics rule query

KQL functions can encapsulate cross-workspace queries using the `workspace()` expression, allowing an analytics rule to query multiple Log Analytics workspaces from a single rule definition. This approach efficiently reuses the union logic across rules without modifying each rule individually, addressing the limitation that built-in rules can only query their own workspace.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • ✗

    Use Azure Lighthouse to delegate management and then create rules in the managing workspace that use workspace() expressions

    Why it's wrong here

    Azure Lighthouse provides cross-tenant management and delegated access, but it does not alter where Sentinel analytics rules execute. Every rule runs in its own Log Analytics workspace context, and while workspace() expressions can reference other workspaces, Lighthouse is not required for that syntax. To query multiple workspaces in one rule, you must explicitly union workspace() expressions or use a saved function; Lighthouse alone will not aggregate data.

  • ✓

    Create a KQL function that unions the relevant tables from all workspaces using the workspace() expression, then use that function in the analytics rule query

    Why this is correct

    The recommended pattern is to create a KQL saved function that unions the target tables from every workspace using workspace() expressions, for example: union workspace('ws1').SecurityEvent, workspace('ws2').SecurityEvent. Then you reference that function directly inside the analytics rule query, allowing the rule to evaluate events across all workspaces in a single execution. This approach is reusable, keeps the rule query clean, and is the standard way to achieve multi-workspace detection in Microsoft Sentinel.

  • ✗

    Configure the analytics rule to run in Log Analytics workspace manager and use cross-workspace queries native to Copilot for Security

    Why it's wrong here

    There is no such feature as 'Log Analytics workspace manager' in Microsoft Sentinel, and Copilot for Security is an AI assistant for security teams, not a query engine or a service that hosts analytics rules. Analytics rules must be defined in a Sentinel workspace, and their queries can only span multiple workspaces by explicitly using workspace() expressions in KQL. This option conflates unrelated products and does not describe a real capability.

  • ✗

    Enable cross-workspace incident view in Sentinel settings and define the rule in the central workspace to automatically query all linked workspaces

    Why it's wrong here

    The cross-workspace incident view in Sentinel settings aggregates incidents from multiple workspaces into a single queue for triage, but it does not change the underlying data source of analytics rules. When you define a rule in the central workspace, the query runs only against that workspace's tables unless you include workspace() expressions to explicitly pull data from other workspaces. Enabling the incident view has no effect on rule query scope, so it will not automatically query all linked workspaces.

About these practice questions

This SC-200 question is part of Courseiva's 209-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Same concept, more angles

1 more way this is tested on SC-200

These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.

Variation 1. A SOC team uses Microsoft Sentinel with multiple workspaces distributed across different regions. They need to create a single analytics rule that can query data from multiple workspaces to detect cross-tenant attacks. What is the recommended approach?

hard
  • A.Create separate analytics rules for each workspace
  • ✓ B.Use cross-workspace queries in a single analytics rule with the workspace() function
  • C.Create a union workspace that ingests data from all workspaces
  • D.Use Azure Lighthouse to manage multiple workspaces and create rules on each

Why B: The recommended approach is to use cross-workspace queries in a single analytics rule with the workspace() function. This allows the rule to query data from multiple Sentinel workspaces in different regions without duplicating rules or ingesting data centrally. The workspace() function enables a single KQL query to reference tables from up to 100 workspaces, making it ideal for detecting cross-tenant attacks across distributed environments.

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.