Design security operations, identity, and compliance capabilities →hardMultiple ChoiceObjective-mapped
SC-100 Practice Question: Design security operations, identity, and compliance capabilities
Your organization has Microsoft Sentinel. You need to create an analytics rule that detects when a user account is created outside of business hours (9 AM to 5 PM, Monday-Friday). Which KQL query should you use as the rule query?
⚠ Common exam trap
The trap here is that `dayofweek()` uses a 1-based index starting on Sunday (1), not Monday (1), so candidates often incorrectly use `between (1 .. 5)` expecting Monday through Friday, but that actually covers Sunday through Thursday.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
... | where dayofweek(TimeGenerated) between (2 .. 6) and datetime_part("hour", TimeGenerated) !between (9 .. 17)
`dayofweek()` returns 1 for Sunday, 2 for Monday, ..., 7 for Saturday. To represent Monday (2) through Friday (6), the range must be `between (2 .. 6)`. The `!between (9 .. 17)` correctly excludes the 9 AM to 5 PM business hours, so the rule triggers only when a user account is created outside those hours on a weekday.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
... | where dayofweek(TimeGenerated) between (1 .. 5) and datetime_part("hour", TimeGenerated) !between (9 .. 17)
Why it's wrong here
This query incorrectly maps dayofweek(1) to Monday when KQL actually treats Sunday as 1 and Saturday as 7. The range 1..5 therefore selects Sunday through Thursday, excluding Friday entirely and including the weekend day Sunday, which violates the requirement for Monday through Friday only. Even though the hour condition is correct (outside 9..17), the day filter makes the overall logic fail because it misses Friday business off-hours and captures Sunday off-hours.
- ✓
... | where dayofweek(TimeGenerated) between (2 .. 6) and datetime_part("hour", TimeGenerated) !between (9 .. 17)
Why this is correct
This query is correct because KQL's dayofweek() returns an integer where Sunday=1, Monday=2, ..., Saturday=7. The range 2..6 therefore includes Monday, Tuesday, Wednesday, Thursday, and Friday exactly, and the !between (9..17) operator excludes hours that are greater than or equal to 9 and less than or equal to 17, so only hours before 9 AM or after 5 PM remain. Combining these conditions with AND yields all events that occurred on weekdays and outside standard business hours, which is precisely the requirement.
- ✗
... | where dayofweek(TimeGenerated) between (2 .. 6) and datetime_part("hour", TimeGenerated) between (9 .. 17)
Why it's wrong here
This query fails because the time filter uses between (9..17) instead of !between, meaning it includes events whose hour is from 9 to 17 inclusive. That captures events during the standard workday (9 AM to 5 PM) and excludes events before 9 AM or after 5 PM, the exact opposite of the required 'outside business hours.' Moreover, because between is inclusive of both endpoints, hours exactly 9 and 17 are included, further confirming that this selects the wrong portion of the day.
- ✗
... | where dayofweek(TimeGenerated) !between (2 .. 6) or datetime_part("hour", TimeGenerated) between (9 .. 17)
Why it's wrong here
This query uses an OR logical operator where the requirement demands an AND. The expression dayofweek !between (2..6) selects all weekend days (Sunday and Saturday) and the hour between (9..17) selects all business-hours events on any day. The union of these two sets therefore includes weekend events regardless of time and weekday events during working hours, completely missing the target of weekday events outside working hours. The proper negation of the correct condition should be an AND of the two negated clauses, not an OR.
Go deeper
Related to this question
About these practice questions
This SC-100 question is part of Courseiva's 208-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-100 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-100 exam.