hardMultiple ChoiceObjective-mapped
SC-200 Practice Question: A SOC team wants to use Microsoft Sentinel to…
A SOC team wants to use Microsoft Sentinel to detect when a user logs in from a new country not previously seen for that user. They have the SigninLogs table. Which KQL function is most appropriate to build this anomaly detection?
⚠ Common exam trap
Microsoft often tests the distinction between aggregate functions that return counts (`dcount`) versus those that return the actual set of values (`make_set`), leading candidates to choose `dcount` when they need to compare individual values against a historical list.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
make_set() with lookup
The `make_set()` function creates a dynamic array of distinct values (e.g., countries) per user over a specified time window. By using `lookup` to compare the current sign-in's country against the historical set, you can flag logins from countries not previously seen. This directly implements the 'new country' anomaly detection pattern in KQL.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
timechart()
Why it's wrong here
timechart() is a rendering operator in KQL that aggregates values over time to produce a trend chart. It is designed for visualizing time-series data, such as login counts per day, not for maintaining a historical set of values per user. In this detection scenario, timechart() cannot return or compare a set of previously seen countries against a new login, so it is not a viable option for detecting a user logging in from a new country.
- ✓
make_set() with lookup
Why this is correct
make_set() creates a dynamic array of distinct values for each user, effectively building a baseline of historically seen countries by grouping on the user column and applying make_set(Country). When a new login occurs, you can use a lookup or join operation to retrieve that user's set and then check whether the current Country exists in the array using array_contains() or the set_has_element operator. This allows you to flag any login from a country not present in the user's set, making make_set() with lookup the correct and direct method for this anomaly detection logic.
- ✗
dcount()
Why it's wrong here
dcount() returns an approximate count of distinct values in a column using the HyperLogLog algorithm, which is efficient for large volumes of data but yields only a numeric cardinality. Since dcount() does not return the actual set of values, you cannot check whether a specific country, such as the one in the current login, is present in the user's historical set. Consequently, dcount() cannot support the comparison required for detecting a login from a new country.
- ✗
startofday()
Why it's wrong here
startofday() is a scalar datetime function that rounds a given timestamp down to the beginning of its day, commonly used for grouping or binning log events into daily periods. It has no capability to store or retrieve historical data such as a list of countries per user, nor does it perform any set operations. While it might be useful for aggregating logins by day, it cannot help determine whether a specific country is new for a user.
Go deeper
Related to this question
About these practice questions
One of 209 original SC-200 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.