mediumMultiple ChoiceObjective-mapped
SC-200 Practice Question: A security analyst in Microsoft Sentinel is…
A security analyst in Microsoft Sentinel is creating a scheduled analytics rule to detect multiple failed logon attempts from the same source IP address. The rule should generate an incident only when the count of failed logons exceeds 10 within a 5-minute window. Which configuration setting is essential to limit the incident generation to this threshold?
⚠ Common exam trap
Many exam-takers confuse the alert threshold with query scheduling or event grouping, leading candidates to think that setting the run interval to 5 minutes alone ensures the threshold is met, when in fact the threshold is a separate mandatory configuration.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Alert threshold set to a value of 10
The alert threshold setting in a Microsoft Sentinel scheduled analytics rule directly controls the minimum number of query results required to generate an incident. By setting the threshold to 10, the rule will only fire when the query returns more than 10 failed logon events within the 5-minute window, matching the requirement exactly.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Event grouping set to 'Group all events into a single alert'
Why it's wrong here
Event grouping set to 'Group all events into a single alert' determines whether all query results from a single run are combined into one alert or each result produces its own alert. This setting bundles matching results into a single alert to reduce alert noise, but it does not establish any minimum result count; even a single returned event can trigger an incident when no threshold is configured, so it cannot enforce a 'high count' condition.
- ✓
Alert threshold set to a value of 10
Why this is correct
Alert threshold set to a value of 10 specifies the minimum number of records that the rule's query must return before an alert is generated. Runs that produce fewer than 10 results are completely ignored, which filters out low-volume, benign matches and ensures an incident is created only when at least 10 events match the rule's logic. This is the correct mechanism for requiring a statistically significant number of results before escalating to an incident.
- ✗
Query scheduling set to run every 5 minutes
Why it's wrong here
Query scheduling set to run every 5 minutes controls how often the rule's KQL query is executed, affecting detection latency and the query's cost. A shorter schedule means results are checked more frequently, but it does not alter the minimum number of results required to generate an incident; each run is independently evaluated against the alert threshold, so a query returning only a handful of events will never fire regardless of how many times it runs.
- ✗
Entity mapping for source IP address
Why it's wrong here
Entity mapping for source IP address enriches an alert by tying the source IP field in the query results to a recognized Sentinel entity, enabling entity pages, investigations, and similar-alert correlation. It adds context and analytics value but imposes no numeric condition on the query output; entity mapping cannot filter out alerts based on the number of occurrences, so it has no role in enforcing a minimum result count for incident creation.
Go deeper
Related to this question
About these practice questions
One of 209 original SC-200 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.