hardMultiple Choice
How to Use _GetWatchlist to Filter Allowed IPs in KQL
A SOC analyst is creating a scheduled analytics rule in Microsoft Sentinel to detect sign-ins from IP addresses that are not in the organization's known allow list. The allow list is maintained in a custom watchlist named 'AllowedIPs'. The analyst wants the KQL query to efficiently filter out allowed IPs. Which KQL approach should the analyst use?
Quick Answer
The correct approach is to use the _GetWatchlist('AllowedIPs') function with the '!in' operator. This works because _GetWatchlist dynamically retrieves the watchlist content at query runtime, and the '!in' operator efficiently filters out any IP addresses that match entries in that list, avoiding hardcoded values or inefficient row-by-row comparisons. On the SC-200 exam, this scenario tests your understanding of how to leverage Microsoft Sentinel’s watchlist functions for dynamic threat detection, often appearing in analytics rule creation questions. A common trap is to use a static list or a subquery with 'where not in', which fails to update automatically when the watchlist changes. Remember the key: _GetWatchlist pulls the list live, and '!in' excludes matches—think of it as “get the list, then kick out the known good.”
⚠ Common exam trap
It's easy for candidates to confuse the 'lookup' operator with filtering, or assume a static 'let' statement is acceptable, failing to recognize that watchlists are designed for dynamic, centrally managed data that must be referenced at query runtime.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use the _GetWatchlist('AllowedIPs') function and filter with the '!in' operator.
The _GetWatchlist('AllowedIPs') function retrieves the watchlist content at query runtime, and combining it with the '!in' operator efficiently filters out sign-ins from IPs present in the watchlist. This approach is dynamic, meaning updates to the watchlist are automatically reflected without modifying the query, and it avoids hardcoding IPs or using inefficient row-by-row lookups.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use the 'lookup' operator to map IPs against the watchlist.
Why it's wrong here
The lookup operator requires the watchlist to be materialised as a table and matches on a single key column, so it cannot reference the 'AllowedIPs' watchlist directly by name within the query. It is tempting because lookup performs dimension enrichment, which suits joining reference data already ingested into a workspace table.
- ✗
Use a 'let' statement to define a static list of allowed IPs.
Why it's wrong here
A static 'let' list hard-codes the allow list inside the query text, so it never reflects the 'AllowedIPs' watchlist and must be edited manually whenever the list changes. It is tempting because 'let' defines reusable constants cheaply, which suits fixed thresholds or small lists that rarely change.
- ✓
Use the _GetWatchlist('AllowedIPs') function and filter with the '!in' operator.
Why this is correct
Using `_GetWatchlist('AllowedIPs')` pulls the watchlist into the query, then `!in` excludes those addresses from the sign-in results. This directly satisfies the requirement to filter out allow-listed IPs efficiently, since the function reads the watchlist at query time without hard-coding values into the KQL.
- ✗
Use the 'evaluate' operator with a python script.
Why it's wrong here
The evaluate operator with a Python script runs inline Python over the query stream, which cannot read the 'AllowedIPs' watchlist and adds a sandbox dependency to a scheduled rule. It is tempting because evaluate plugins extend KQL with anomaly detection and statistical functions, which suits advanced modelling rather than simple allow-list filtering.
Go deeper
Related to this question
About these practice questions
One of 1,303 original SC-200 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SC-200
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A SOC analyst wants to create a Microsoft Sentinel scheduled analytics rule that alerts when a user from a critical department (e.g., Finance) logs on from an IP address that is not in the company's approved IP address ranges. The analyst has an Azure Sentinel watchlist named 'FinanceApprovedIPs' containing the allowed IP ranges. Which KQL operator should be used in the rule's query to efficiently check if the IP address from SigninLogs falls within any of the watchlist ranges?
medium- ✓ A.join kind=inner (watchlist) on $left.IPAddress $right.IPRange with condition using ipv4_is_in_range() or ipv4_lookup()
- B.where IPAddress has any (watchlist)
- C.where IPAddress in (watchlist)
- D.where IPAddress startswith (watchlist)
Why A: The `ipv4_lookup()` function (or `ipv4_is_in_range()` used with a join) is specifically designed to efficiently check whether an IP address falls within a range defined in a watchlist. In Microsoft Sentinel, watchlists store data as tables, and `ipv4_lookup()` performs a range-based lookup using CIDR notation, which is far more efficient than string-based or exact-match operators. This allows the query to match the `IPAddress` from `SigninLogs` against the `IPRange` column in the `FinanceApprovedIPs` watchlist without iterating over every possible address.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.