Perform threat hunting →hardMultiple Choice

SC-200 Perform threat hunting Practice Question

Exhibit

Refer to the exhibit.
```kusto
let timeframe = 7d;
let maliciousIPs = externaldata(IP:string)
["https://raw.githubusercontent.com/.../malicious_ips.txt"]
with (format="csv");
DeviceNetworkEvents
| where Timestamp > ago(timeframe)
| where RemoteIP in (maliciousIPs)
| summarize count() by DeviceName, RemoteIP
```

You run the KQL query above in Microsoft Sentinel. The query returns zero results even though you know some devices have connected to malicious IPs. What is the most likely cause?

⚠ Common exam trap

SC-200 often tests the externaldata operator's dependency on external source accessibility, and candidates may overlook network or permission issues, assuming the query logic is correct.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The externaldata source URL is inaccessible from the Sentinel workspace.

The most likely cause is that the externaldata source URL is inaccessible from the Sentinel workspace. The externaldata operator in KQL retrieves data from an external storage location, such as an Azure Storage blob or a public URL. If the URL is unreachable due to network restrictions, authentication issues, or incorrect permissions, the query will return zero results even if the data exists. This is a common pitfall when using externaldata in Microsoft Sentinel.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
The externaldata source URL is inaccessible from the Sentinel workspace.
Why this is correct
If the externaldata URL cannot be reached from the workspace, the query returns no rows because the external source yields nothing to join or filter. Connectivity to that URL is the prerequisite the query depends on.
✗
The malicious IPs are not in the list.
Why it's wrong here
The user knows they are.
✗
The DeviceNetworkEvents table does not contain the RemoteIP column.
Why it's wrong here
DeviceNetworkEvents has RemoteIP.
✗
The let statement syntax is incorrect.
Why it's wrong here
The syntax is valid.

Go deeper

SC-200 Perform threat hunting Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question