SC-200 Perform threat hunting Practice Question
Which TWO KQL operators are commonly used in threat hunting to join tables based on a key?
⚠ Common exam trap
SC-200 often tests the distinction between operators that combine tables (join, lookup, union) versus those that transform a single table (extend, summarize), and candidates may mistakenly select `union` for key-based joins.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
lookup
Option A, lookup, is correct because it enriches events by joining a fact table with a dimension table on a matching key column, returning only the columns from the lookup table and is optimized for this common threat-hunting enrichment pattern. Option B, join, is correct because it combines rows from two tables based on matching values of a specified key column (e.g., join kind=inner on Account), which is the general-purpose operator for correlating tables in KQL. Option C, extend, is not a join operator; it adds or computes new columns on a single table. Option D, summarize, aggregates rows into groups using functions like count() or dcount(), not a key-based table join. Option E, union, appends rows from multiple tables into one result set without matching on a key.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
lookup
Why this is correct
The lookup operator enriches a fact table by pulling values from a dimension-style table based on equality of specified keys, using left-outer semantics that preserve the left side's row count and only add columns. This is essential in threat hunting for attaching authoritative context—such as user names, asset owners, or threat-intel tags—to raw events without the risk of row multiplication. Unlike join, lookup is optimized for dimension-style, one-to-many enrichment and is a common choice when the goal is to decorate events with descriptive attributes.
- ✓
join
Why this is correct
The join operator merges columns from two tabular inputs by matching rows on specified equal keys, and it supports multiple flavors such as inner, leftouter, rightouter, fullouter, and anti, making it the generic relational workhorse for correlating logs. In threat hunting, join is commonly used to pull together evidence from separate data sources—for example, linking authentication events to process starts or matching network connections to malware alerts—when the exact relationship may be one-to-many. Because join can produce multiple matches, it is more powerful than lookup but also demands careful reasoning about which join flavor is appropriate.
- ✗
extend
Why it's wrong here
The extend operator adds one or more computed columns to every row of the current tabular set, using scalar expressions such as arithmetic, string functions, or iif() logic. It cannot reference a second table, so it has no key-based matching capability and is therefore unsuitable for enriching events with external context. Its value in hunting is narrow: for instance, normalizing timestamps to UTC or extracting a hostname from a field, not correlating threats across data sources.
- ✗
summarize
Why it's wrong here
The summarize operator groups rows by one or more keys and applies aggregate functions like count(), dcount(), sum(), and max(), collapsing many rows into a single summary row per group. This loses the original event-level details, which is often counterproductive in threat hunting where analysts need to inspect individual suspicious actions. It is used for understanding volumes or baselines, not for joining or enriching raw logs on a per-row basis.
- ✗
union
Why it's wrong here
The union operator concatenates the rows of two or more tabular expressions into one table, aligning columns by name or position, so it combines homogeneous logs such as multiple firewall sources. It does not match rows on keys or merge columns from different tables, so it cannot establish relationships between events—the central need in threat hunting. Mistaking union for a table-correlation operator is a common pitfall that leads to flat outputs without enrichment.
Go deeper
Related to this question
About these practice questions
This SC-200 question is part of Courseiva's 1,303-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.