SC-200 Respond to security incidents Practice Question
During a security incident, you need to create a custom detection rule in Microsoft Sentinel to alert on multiple failed logins followed by a successful login from the same IP within 10 minutes. Which KQL function should you use to group events by IP address and time window?
⚠ Common exam trap
SC-200 often tests the misconception that `join` is needed for correlating events, but the question specifically asks for grouping by IP and time window, which is the core purpose of `summarize`.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
summarize
The `summarize` operator is the correct choice because it groups events by one or more columns (e.g., IP address) and performs aggregations over a defined time window. In this scenario, you need to count failed logins and then check for a subsequent successful login within 10 minutes from the same IP, which requires grouping by IP and time. `summarize` allows you to use `bin()` on a timestamp to create time buckets, enabling the detection of multiple failed logins followed by a success within that window. This is the standard KQL approach for time-based correlation in Microsoft Sentinel.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
join
Why it's wrong here
join correlates rows across tables on matching keys, but cannot bucket events into a 10-minute window per IP; it lacks the time-binning semantics. It is tempting because joining failed and successful login tables by IP seems natural, and join is correct when correlating discrete datasets on a shared column without time aggregation.
- ✗
extend
Why it's wrong here
extend appends calculated columns to each row; it neither groups rows nor assigns them to time windows, so per-IP sequences across 10 minutes cannot be formed. It is tempting because you can compute a timestamp column, and extend is correct when adding derived fields without changing row cardinality.
- ✗
project
Why it's wrong here
project selects, renames or drops columns and computes scalars; it performs no grouping or time-window aggregation, so it cannot bin events by IP within 10 minutes. It is tempting as a cleanup step before summarising, and project is correct when you need to shape the output schema of a query.
- ✓
summarize
Why this is correct
The summarize operator aggregates rows into groups defined by your chosen dimensions, letting you bin events by IP address and a ten-minute time bucket, then apply count() and threshold logic to detect the failed-then-successful pattern within the required window.
Go deeper
Related to this question
About these practice questions
One of 1,303 original SC-200 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.