SC-200 Practice Question 3834
Exam: SC-200
Domain: Perform threat hunting
Difficulty: hard
In KQL, what is the operational difference between the `has` string operator and the `contains` string operator?
Answer Options
A
`has` searches for exact whole terms (indexed); `contains` searches substrings (non-indexed)
B
`has` searches for substrings; `contains` searches only numeric values
C
There is no functional or performance difference between the two
D
`has` works only on Linux tables; `contains` works only on Windows tables
Correct Answer
A: `has` searches for exact whole terms (indexed); `contains` searches substrings (non-indexed)
Explanation
The `has` operator searches for an exact whole term or word boundary (indexed, high-speed performance); the `contains` operator searches for any arbitrary substring (non-indexed, slower performance).