Design security operations, identity, and compliance capabilities →hardMultiple ChoiceObjective-mapped
SC-100 Microsoft Sentinel analytics rule Practice Question
Your organization uses Microsoft Sentinel. You need to design a solution to detect and automatically respond to a potential brute-force attack against an on-premises application that is published via Azure AD Application Proxy. The solution should block the attacker's IP address in Azure AD Conditional Access for one hour after detecting more than 10 failed login attempts within 5 minutes. What should you implement?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a Microsoft Sentinel analytics rule that triggers on a KQL query detecting the failed logins, then use a playbook to add the IP to a Conditional Access block list via the Azure AD API.
You can create a Microsoft Sentinel analytics rule with a KQL query that detects more than 10 failed login attempts within 5 minutes. When the rule triggers, it runs a playbook that uses the Azure AD API to add the attacker's IP to a Conditional Access block list, blocking further access for one hour. Option A is incorrect because Microsoft Purview DLP policies are for data protection, not authentication blocking. Option C is incorrect because a WAF rate limit blocks at the network layer but does not integrate with Azure AD Conditional Access, and it cannot read authentication logs from Azure AD App Proxy. Option D is incorrect because Microsoft Entra ID Protection sign-in risk policies are user-based and cannot block specific IPs or apply custom logic like a 1-hour block.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a Microsoft Purview Data Loss Prevention policy to block the IP address based on the login pattern.
Why it's wrong here
Microsoft Purview Data Loss Prevention (DLP) policies inspect content for sensitive information types across Exchange, SharePoint, OneDrive, Teams, and endpoints; they do not ingest Azure AD sign-in telemetry or IP reputation data. DLP is designed to prevent unauthorized sharing or exfiltration of sensitive data, not to enforce network-level or identity-level access decisions. Consequently, Purview DLP has no triggers, connectors, or remediation actions that can act on a pattern like '10 failed logins from an IP in 5 minutes.' It cannot add any IP to a Conditional Access block list, so this option is fundamentally mismatched to the requirement.
- ✓
Create a Microsoft Sentinel analytics rule that triggers on a KQL query detecting the failed logins, then use a playbook to add the IP to a Conditional Access block list via the Azure AD API.
Why this is correct
Microsoft Sentinel can ingest sign-in logs from Azure AD Application Proxy. An analytics rule with a KQL query can detect the brute-force pattern, and when triggered, a playbook can call the Azure AD API to add the IP to a Conditional Access block list for one hour, effectively blocking the attacker.
- ✗
Deploy a web application firewall (WAF) in front of the application and configure rate limiting to block the IP.
Why it's wrong here
A WAF can rate-limit requests at the network level but does not have access to Azure AD authentication logs. It cannot differentiate between successful and failed logins, nor can it directly update Conditional Access policies.
- ✗
Configure a Microsoft Entra ID Protection sign-in risk policy to automatically block the user's sign-in after detecting anomalous activity.
Why it's wrong here
Microsoft Entra ID Protection sign-in risk policies block risky user sessions, but they cannot block specific IP addresses or enforce a fixed-time block (e.g., one hour) based on custom thresholds like 10 failures in 5 minutes.
Go deeper
Related to this question
Learn chapter
Governance, Risk, and Compliance Strategy Design
Key term
SOC Architecture
SOC Architecture is the structured design of people, processes, and technology in a Security Operations Center to detect, analyze, and respond to cyber threats.
Key term
Microsoft 365 Security Design
Microsoft 365 Security Design is the process of planning and configuring built-in security features in Microsoft 365 to protect data, identities, and devices from cyber threats.
About these practice questions
This SC-100 question is part of Courseiva's 208-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-100 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-100 exam.