SC-200 Perform threat hunting Practice Question
Your security team uses Microsoft Sentinel to hunt for signs of credential theft. They want to correlate Microsoft Entra ID sign-in logs with Microsoft Defender for Cloud Apps alerts. Which KQL operator should they use to join the two tables on the user principal name?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
join
The 'join' operator merges rows from two tables based on a matching key. Option A is incorrect because 'union' appends rows, not correlates. Option C is incorrect because 'lookup' is a type of join but is less common for this scenario. Option D is incorrect because 'evaluate' is used for plugin execution, not joining tables.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
union
Why it's wrong here
union is wrong because it vertically appends rows from multiple tables or tabular expressions; each input keeps its own schema and missing columns are filled with nulls. It never evaluates a matching condition, so it cannot correlate sign-in events with alerts on a shared entity such as account or IP. In Microsoft Sentinel hunting queries, union is appropriate for combining similar tables, but it leaves related rows separate rather than producing one enriched row per match.
- ✓
join
Why this is correct
join is correct because the KQL join operator correlates rows from two tabular expressions on one or more equality conditions (keys), returning rows that contain columns from both sides. For example, joining SigninLogs with AADAuditLogs on UserId or IP address lets you see a logon event and the subsequent activity side by side, which is exactly the kind of key-based matching needed when hunting across heterogeneous data sources. You can control the output with join kinds such as innerunique, inner, leftouter, and rightouter to tailor the hunt to your hypothesis.
- ✗
lookup
Why it's wrong here
lookup is wrong because it is designed to enrich rows from a primary ('fact') table with attributes from a secondary ('dimension') table, not to correlate two event streams. In KQL, the right-hand table in a lookup is expected to have unique key values, and lookup returns only the left-side rows plus the matched enrichment columns, effectively behaving as a left outer join. When hunting, you would use lookup to add a user's department or device owner to existing events, but a true join is required when both tables contain multiple events that share the same key and you need all combinations.
- ✗
evaluate
Why it's wrong here
evaluate is wrong because it only invokes a plugin—a stored or tabular function such as autocluster, bag_unpack, or pivot—that extends Kusto's capabilities, and it does not accept two table expressions plus a join key. Plugins can perform analytics or shape data, but none of them perform the generic key-based row correlation that the query needs. Attempting to use evaluate to link Sentinel tables would fail syntactically because evaluate expects a plugin name, not a keyed relationship between two data sets.
Go deeper
Related to this question
About these practice questions
One of 1,303 original SC-200 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.