SC-200 Perform threat hunting Practice Question
During a threat hunt, a security analyst uses Microsoft Sentinel and identifies a series of failed logon attempts from a single IP address targeting multiple user accounts. The analyst wants to create a scheduled analytics rule that generates an alert when the same IP address fails to logon to more than 10 different accounts within 5 minutes. Which KQL operator should be used to count distinct accounts per IP?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
dcount(Account)
Dcount(Account). The dcount() function performs an approximate distinct count, which is efficient for large datasets and suitable for counting distinct accounts per IP. Option A (count()) counts all events, not distinct accounts. Option B (summarize count() by Account) counts events per account, not distinct accounts per IP. Option C (distinct Account) returns unique account values but does not provide a count.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
count()
Why it's wrong here
count() counts all events, not distinct user accounts.
- ✗
summarize count() by Account
Why it's wrong here
This counts events per account, not distinct accounts across events.
- ✗
distinct Account
Why it's wrong here
distinct returns unique accounts but does not count them.
- ✓
dcount(Account)
Why this is correct
dcount provides an approximate distinct count of accounts, suitable for performance.
Go deeper
Related to this question
About these practice questions
One of 209 original SC-200 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.