Microsoft SC-200

Correct. The query must begin with the Microsoft Graph query source/function so Sentinel can retrieve Microsoft Graph data before combining it with Entra ID Protection risky user data. To minimize returned volume, that Graph result should then be filtered and projected as early as possible before any join or union. This matches the requirement to combine Microsoft Graph with risky users while keeping the dataset small. In SC-200 questions, the key discriminator is often recognizing the correct KQL starting construct for the data source rather than a generic let statement.

Incorrect. A generic let statement is not, by itself, the required starting point for querying Microsoft Graph data in Sentinel. While let can help with readability and reuse, it does not identify the correct source needed to pull Microsoft Graph data. If the option does not start with the Graph-specific query construct, it would not satisfy the requirement as directly as the correct answer. Optimization techniques like where and project are important, but they come after selecting the proper source.

Incorrect. Starting with the risky users table alone does not address the need to query Microsoft Graph data as one of the required sources. Even if you later join to another dataset, the question asks how the query should start to combine Microsoft Graph and Entra ID Protection data. Beginning from only the risky users side misses the Graph-specific entry point being tested. It may also lead to a less direct and less exam-aligned solution.

Incorrect. Starting with a union, join, or another broad combining operator before establishing the Microsoft Graph source is not the best way to satisfy the requirement. You should first invoke the correct Graph query source and reduce that dataset before combining it with risky users. Combining too early can increase processing and returned data volume. This also fails the exam pattern of identifying the proper initial KQL construct for Microsoft Graph integration.