Design security operations, identity, and compliance capabilities →hardMultiple ChoiceObjective-mapped
SC-100 Practice Question: Design security operations, identity, and compliance capabilities
Your organization uses Microsoft Defender XDR to correlate alerts across endpoints, email, and identities. You need to create a custom detection rule that triggers when a user receives a phishing email and then attempts to log in from a new location. Which approach should you use?
⚠ Common exam trap
Many candidates confuse the scope of custom detection rules in Defender for Endpoint (endpoint-only) with the cross-domain capability of Advanced Hunting in Defender XDR, or they mistakenly think automation rules can create new detection logic rather than just automate responses to existing alerts.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use Advanced Hunting to create a custom detection rule
Advanced Hunting in Microsoft Defender XDR allows you to write Kusto Query Language (KQL) queries that correlate events across multiple data tables (e.g., EmailEvents, IdentityLogonEvents). You can then create a custom detection rule from that query, which will trigger an alert when a user receives a phishing email and subsequently logs in from a new location, enabling cross-domain correlation within Defender XDR.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use Advanced Hunting to create a custom detection rule
Why this is correct
Advanced Hunting is the XDR-native KQL query interface spanning the unified Defender XDR data schema, including endpoint, email, identity, and cloud app tables. By saving an advanced hunting query as a custom detection rule, Defender XDR continuously evaluates cross-domain signals and generates alerts, making it the correct mechanism for correlating evidence from multiple sources.
- ✗
Create a custom detection rule in Microsoft Defender for Endpoint
Why it's wrong here
Custom detection rules in Defender for Endpoint are confined to the endpoint telemetry tables (for example, DeviceProcessEvents and DeviceNetworkEvents). They cannot query email, identity, or cloud app events, so they are incapable of performing the cross-domain correlation the scenario requires. This option addresses only one pillar of the XDR scope, not the full picture.
- ✗
Use an automation rule in Microsoft Defender XDR
Why it's wrong here
Automation rules in Defender XDR execute response actions—such as changing incident status, assigning ownership, or triggering playbooks—on alerts and incidents that already exist. They do not write new KQL logic or process raw queries, and therefore cannot create correlation logic from scratch. This option is about reacting to detections, not generating them.
- ✗
Create an analytics rule in Microsoft Sentinel
Why it's wrong here
Analytics rules in Microsoft Sentinel operate in the separate Log Analytics workspace and require onboarding XDR connectors plus writing KQL against a different schema. Although Sentinel can ingest Defender XDR signals, using it bypasses the native, unified XDR correlation engine and adds unnecessary architectural complexity. Because the requirement is to use Microsoft Defender XDR itself, the native Advanced Hunting custom detection rule is the direct and intended approach.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SC-100 question from scratch — 208 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-100 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-100 exam.