SC-200 Practice Question 3848
Exam: SC-200
Domain: Perform threat hunting
Difficulty: hard
What is the purpose of the KQL `materialize()` function when building complex, multi-stage threat hunting queries in Microsoft Sentinel?
Answer Options
A
Caches intermediate subquery results in memory to avoid repeated evaluation
B
Converts digital data into physical paper printouts
C
Encrypts query outputs with an SSL key
D
Deletes old tables from the database
Correct Answer
A: Caches intermediate subquery results in memory to avoid repeated evaluation
Explanation
The `materialize()` function caches the intermediate result of a subquery in memory during query execution, preventing the query engine from re-evaluating the same expensive expression multiple times.