SC-200 Perform threat hunting Practice Question
During a threat hunt, you discover suspicious PowerShell commands executed on multiple workstations. Which KQL function in Microsoft Sentinel is most effective for aggregating similar commands to identify a pattern?
⚠ Common exam trap
SC-200 often tests KQL operator semantics — candidates confuse extend (adds columns) with summarize (aggregates rows), or pick search because it sounds like it finds patterns.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
summarize
The summarize operator in KQL groups rows by specified columns and computes aggregations such as count, making it ideal for aggregating similar PowerShell commands to reveal patterns. By summarizing on CommandLine or a normalized field, analysts can count occurrences and spot outliers. The other operators transform or filter but do not aggregate.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
summarize
Why this is correct
summarize groups rows by chosen keys and computes aggregates such as count or make_set, letting you collapse many similar PowerShell command lines into per-host or per-command patterns. That aggregation exposes commands recurring across workstations, which raw row-by-row output obscures.
- ✗
extend
Why it's wrong here
extend adds calculated columns to each row; it operates per record and performs no grouping, so identical commands are never collapsed into a pattern. It is tempting because it derives new fields such as extracted command names, and would be correct when you need to enrich rows before summarising them.
- ✗
search
Why it's wrong here
search scans across tables for a keyword but returns raw matching rows, so it cannot group similar PowerShell command lines into patterns. It is tempting because it spans multiple tables without naming them, and would be correct when you need a broad, quick keyword sweep across the workspace rather than aggregation.
- ✗
project
Why it's wrong here
project selects and renames a subset of existing columns, leaving row cardinality unchanged, so similar commands remain separate rows. It is tempting because it trims noisy output to the fields you care about, and would be correct when the requirement is shaping columns for display rather than aggregating commands.
Go deeper
Related to this question
About these practice questions
One of 1,303 original SC-200 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.