Manage security and threats by using Microsoft Defender XDR →hardMultiple ChoiceObjective-mapped

MS-102 Practice Question: Manage security and threats by using Microsoft Defender XDR

A security analyst needs to create a custom detection rule in Microsoft Defender XDR that triggers when a device communicates with a new, unclassified IP address flagged by Microsoft threat intelligence as potentially malicious. The rule must run every hour and create an incident if the count of such communications exceeds 10 in a 24-hour window. Which type of rule should the analyst create?

⚠ Common exam trap

Test-takers frequently confuse the scope of Microsoft Defender XDR custom detections with Microsoft Sentinel scheduled alert rules, assuming any scheduled query must be in Sentinel, but Defender XDR's advanced hunting custom detections natively support scheduled queries and incident creation without requiring Sentinel.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

custom detection rule using advanced hunting

A custom detection rule using advanced hunting is the correct choice because Microsoft Defender XDR allows you to create custom detection rules based on Kusto Query Language (KQL) queries that run on a scheduled interval (e.g., every hour). This rule can query the `DeviceNetworkEvents` table to identify communications with IP addresses flagged as malicious by Microsoft threat intelligence, aggregate the count over a 24-hour sliding window, and trigger an incident when the threshold of 10 is exceeded. This directly meets the requirement for a scheduled, threshold-based detection within Defender XDR.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
custom detection rule using advanced hunting
Why this is correct
Custom detection rules in Microsoft Defender XDR are built on advanced hunting queries written in Kusto Query Language (KQL). These queries can be scheduled to run periodically across the tenant's extended data schema, and when the query results meet defined thresholds, the rule generates an incident for investigation. This is the native mechanism for creating custom detections directly within the Defender XDR portal, making it the correct choice.
✗
scheduled alert rule in Microsoft Sentinel
Why it's wrong here
Microsoft Sentinel is a separate cloud-native SIEM that ingests data from many sources, including Microsoft Defender XDR, but it operates in its own portal and workspace. A scheduled alert rule in Sentinel is a detection mechanism for that SIEM, not a rule defined within Defender XDR. Since the security analyst needs to create the detection within Defender XDR itself, this option is incorrect for this scenario.
✗
An incident creation rule in Microsoft Defender for Cloud Apps
Why it's wrong here
Microsoft Defender for Cloud Apps (MCAS) incident creation rules govern how alerts for suspicious SaaS application activity, access policies, and cloud discovery anomalies become incidents. They do not handle network communications or device-level telemetry that would be part of an advanced hunting query in Defender XDR. Thus, this rule type is not the appropriate mechanism for a custom detection targeting device network activity.
✗
custom remediation action rule
Why it's wrong here
A custom remediation action rule in Defender XDR is designed to run automated response actions—such as isolating a device or blocking a file—after a threat has already been detected. It is a post-detection response configuration, not a rule that defines detection logic or triggers an incident based on query results. The requirement is to create a detection rule itself, so this option does not fit the stated need.

Go deeper

MS-102 Practice Question: Manage security and threats by using Microsoft Defender XDR

Why each option matters

Option-by-option breakdown

Related to this question