Design security operations, identity, and compliance capabilities →hardMultiple ChoiceObjective-mapped

SC-100 Practice Question: Design security operations, identity, and compliance capabilities

Your organization uses Microsoft Defender XDR for detection and response. You need to create a custom detection rule that alerts when a user performs more than 10 failed sign-ins from different countries within 5 minutes. Which component should you use?

⚠ Common exam trap

Watch out — candidates often confuse Microsoft Sentinel analytics rules (which require data ingestion) with Microsoft 365 Defender custom detection rules (which operate natively on Defender XDR data), leading them to choose Sentinel options when the question explicitly states 'Microsoft Defender XDR' as the platform.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Custom detection rule in Microsoft 365 Defender

Custom detection rules in Microsoft 365 Defender allow you to define advanced hunting queries that trigger alerts based on specific event patterns, such as more than 10 failed sign-ins from different countries within 5 minutes. This is the correct component because it operates directly on data within the Defender XDR ecosystem (e.g., AADSignInEventsBeta) without requiring data ingestion into Sentinel.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Automation rule in Microsoft Sentinel
Why it's wrong here
Automation rules in Microsoft Sentinel are triggered by incident creation or alert creation to automate response actions such as assigning ownership, changing status, or running playbooks. They do not contain detection logic like KQL queries; their trigger conditions are based on alert/incident properties such as severity or title rather than hunting for signals. Therefore, they cannot serve as a detection mechanism.
✓
Custom detection rule in Microsoft 365 Defender
Why this is correct
Custom detection rules in Microsoft Defender XDR leverage Advanced Hunting Kusto Query Language (KQL) queries to continuously monitor event data across email, endpoints, identities, and cloud apps. When the query returns results, the rule triggers an alert and can also create an incident, enabling bespoke detection logic beyond built-in detections. This is the native detection engine for Defender XDR, distinct from SIEM-based rules.
✗
Analytics rule in Microsoft Sentinel
Why it's wrong here
Analytics rules in Microsoft Sentinel are scheduled or near-real-time detection rules that reside in a SIEM, ingesting data from multiple sources including Defender XDR via connectors. They execute KQL queries against the Log Analytics workspace, but they are separate from the security research team's native detections in Defender XDR. While they can detect threats, they are not part of the Microsoft Defender XDR detection engine and require separate SIEM licensing and configuration.
✗
Attack simulation training
Why it's wrong here
Attack simulation training in Microsoft 365 is a security awareness and behavior-change tool that launches simulated phishing and password-attack campaigns to train users, measuring click-through and report rates. It does not analyze telemetry or generate detection alerts; instead, it produces training efficacy reports. Thus, it is a proactive readiness capability, not a threat-detection mechanism.

Go deeper

SC-100 Practice Question: Design security operations, identity, and compliance capabilities

Why each option matters

Option-by-option breakdown

Related to this question