SC-200 Manage a security operations environment Practice Question
Your SOC team uses Microsoft Sentinel with multiple workspaces across regions. You need to implement a solution that allows analysts to query all workspaces from a single location without moving data. Which feature should you configure?
⚠ Common exam trap
It's easy for candidates to confuse Azure Lighthouse (cross-tenant management) with cross-workspace querying, but Lighthouse does not provide the KQL-level query capability needed to query data across workspaces from a single query.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use cross-workspace queries with workspace() expressions in KQL.
Cross-workspace queries using the `workspace()` expression in KQL allow analysts to query multiple Log Analytics workspaces from a single query context without moving or centralizing the data. This is the native Microsoft Sentinel feature designed for multi-workspace environments, enabling seamless querying across regions while keeping data in its original workspace.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use cross-workspace queries with workspace() expressions in KQL.
Why this is correct
Cross-workspace queries allow querying multiple workspaces without moving data.
- ✗
Export data to Azure Data Explorer and query there.
Why it's wrong here
This moves data and adds cost, not a single location solution.
- ✗
Create a single Log Analytics workspace and have all data sources send logs there.
Why it's wrong here
This moves data, which may violate data residency requirements.
- ✗
Configure Azure Lighthouse to manage all workspaces.
Why it's wrong here
Azure Lighthouse is for cross-tenant management, not querying multiple workspaces.
Go deeper
Related to this question
About these practice questions
One of 209 original SC-200 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.