Perform threat hunting →hardMultiple Choice

SC-200 Perform threat hunting Practice Question

Exhibit

Refer to the exhibit.
```kusto
let TimeRange = 7d;
let SuspiciousIPs = materialize(
   DeviceNetworkEvents
   | where Timestamp > ago(TimeRange)
   | where RemoteIPType == "Public"
   | where RemotePort == 445
   | summarize Count = count() by RemoteIP
   | where Count > 100
);
DeviceNetworkEvents
| where Timestamp > ago(TimeRange)
| where RemoteIP in (SuspiciousIPs)
| summarize ConnectionCount = count() by DeviceName, RemoteIP
```

You are analyzing the KQL query above in Microsoft Sentinel. The query is designed to find devices with high outbound SMB (port 445) connections to suspicious public IPs. However, the query returns no results. What is the most likely issue?

⚠ Common exam trap

SC-200 often tests schema familiarity by presenting a plausible-looking but non-existent column, tempting candidates to blame syntax or functions instead of the invalid field reference.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The column RemoteIPType does not exist in DeviceNetworkEvents.

The query returns no results most likely because it references a column, RemoteIPType, that does not exist in the DeviceNetworkEvents table in Microsoft Sentinel. Referencing a non-existent column causes a query error or empty result, and RemoteIPType is not a standard schema field in that table.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Port 445 is not used for SMB.
Why it's wrong here
Port 445 is the registered TCP port for SMB, so filtering on it is valid and matches real traffic. Choosing 445 is correct whenever SMB file-sharing connections are the target of analysis; the empty result stems from the query's filtering or joining conditions, not the port number.
✓
The column RemoteIPType does not exist in DeviceNetworkEvents.
Why this is correct
DeviceNetworkEvents lacks a RemoteIPType column, so referencing it makes the query fail silently or return nothing. The schema exposes RemoteIP, RemoteUrl and RemotePort instead; filtering public addresses requires an ipv4_is_private() or similar check on RemoteIP. This schema mismatch, not the SMB filter, explains the empty result set.
✗
The materialize function is not allowed in this context.
Why it's wrong here
materialize is a supported KQL operator in Microsoft Sentinel and Log Analytics, so it does not cause an empty result set. It is used to cache a subquery's output for reuse, and would be the right choice when a costly intermediate result is referenced repeatedly within one query.
✗
The syntax for the second query is incorrect.
Why it's wrong here
A syntax error would surface as a query failure with an error message, not as a silent empty result set. Correct syntax is verified by the parser before execution, so this cannot explain zero rows; the actual cause lies in the join or filter logic returning no matching records.

Go deeper

SC-200 Perform threat hunting Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question