SC-200 Perform threat hunting Practice Question
Your threat hunting team uses Microsoft Sentinel. They want to search for anomalous network connections to known malicious IP addresses over the past 7 days. Which KQL operator should they use to match the source IP addresses against a watchlist containing the malicious IPs?
⚠ Common exam trap
SC-200 often tests the confusion between substring operators ('contains'/'has') and set-membership ('in'), tricking candidates into picking 'contains' for exact indicator matching against watchlists.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
in
The 'in' operator is the correct choice because it checks whether a value (the source IP) exists within a specified set — here, the dynamic list of malicious IPs pulled from a Sentinel watchlist via _GetWatchlist(). This is the idiomatic KQL pattern for matching against watchlists and produces an efficient membership test rather than a substring search.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
where
Why it's wrong here
The where operator filters rows by a Boolean expression, so it cannot itself resolve IPs against a watchlist; matching requires the in or lookup operator against the watchlist data. Filtering on a single static condition is what where is for, which suits simple threshold or field comparisons, not list membership.
- ✓
in
Why this is correct
The in operator tests whether a value exists in a dynamic list or watchlist, so source IPs can be matched directly against the malicious IP set. It satisfies the requirement to compare network connection sources with watchlist entries over the past seven days.
- ✗
has
Why it's wrong here
has matches whole terms, so an IP address tokenised on punctuation is not treated as one term, causing missed or imprecise matches against watchlist entries. It is tempting because has is efficient for keyword hunting, and would be correct for matching discrete alphanumeric terms such as process names.
- ✗
contains
Why it's wrong here
contains performs a case-insensitive substring match, so an IP such as 10.0.0.1 would also match 110.0.0.10, producing false positives against the watchlist. It is tempting for free-text log searching, and would be correct when matching partial strings or fragments rather than exact IP values.
Go deeper
Related to this question
About these practice questions
One of 1,303 original SC-200 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.