mediumMultiple ChoiceObjective-mapped
SC-100 Practice Question: A company uses Microsoft 365 Defender to protect…
A company uses Microsoft 365 Defender to protect their endpoints, email, and identities. They want to create a custom detection for a specific behavior that is not covered by built-in detections. Which tool should they use?
⚠ Common exam trap
A common mix-up: candidates confuse Microsoft Sentinel analytics rules with Microsoft 365 Defender custom detection rules because both use KQL and create alerts, but Sentinel is a separate SIEM product, while the question explicitly asks for a tool within Microsoft 365 Defender.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Custom detection rules in Microsoft 365 Defender
Microsoft 365 Defender provides a 'Custom detection' feature under the 'Advanced hunting' section that allows security teams to create custom detection rules based on Kusto Query Language (KQL) queries. This is the correct tool because the question specifies creating a detection for behavior not covered by built-in detections within the Microsoft 365 Defender ecosystem, and custom detection rules are designed exactly for that purpose—they run on a schedule and generate alerts when the custom query matches.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Sentinel analytics rules
Why it's wrong here
Microsoft Sentinel analytics rules operate in a separate SIEM workspace and require data connectors to ingest M365 Defender events before any detection logic can run. They also involve scheduled queries or MITRE ATT&CK-based detections that are not automatically synchronized as native Defender detections. For creating a custom detection that directly runs within M365 Defender's own pipeline, Sentinel rules are an external, indirect approach.
- ✗
Azure AD Identity Protection user risk policies
Why it's wrong here
Azure AD Identity Protection user risk policies evaluate sign-in and user risk levels based on identity-related signals like leaked credentials or anomalous authentication, not on endpoint behavior such as processes, files, or network connections. They also only apply to user accounts, not to devices or other endpoints. Therefore they cannot address the requirement to create custom detections on endpoint activity within M365 Defender.
- ✓
Custom detection rules in Microsoft 365 Defender
Why this is correct
Custom detection rules in Microsoft 365 Defender allow security teams to write KQL queries that run across the rich, normalized data schema (such as DeviceEvents, DeviceProcessEvents, DeviceNetworkEvents, and EmailEvents) natively stored in the Defender platform. These rules can be configured to run on a schedule and generate alerts and incidents, integrating with automated investigation and response capabilities. Because they are native, they require no additional data connectors and they can leverage the full breadth of endpoint, email, and identity data already collected.
- ✗
Microsoft Defender for Cloud Apps policies
Why it's wrong here
Microsoft Defender for Cloud Apps policies govern user behavior and app-level activity across SaaS and cloud platforms, such as anomalous access from risky IPs, OAuth app permissions, or data exfiltration from cloud storage. While they can ingest some signals from other Microsoft 365 Defender workloads, they are not designed to run deep KQL queries on raw endpoint telemetry like processes or file hashes. Thus they cannot meet the requirement for a custom endpoint-centric detection inside M365 Defender.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SC-100 question from scratch — 208 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-100 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-100 exam.