mediumMultiple ChoiceObjective-mapped
SC-200 Practice Question: A security operations center (SOC) uses Microsoft…
A security operations center (SOC) uses Microsoft Sentinel. The team wants to detect anomalous behavior for a specific user account that typically logs in only during business hours from a known IP range. They create a scheduled analytics rule that queries the SigninLogs table for logins outside that range or outside business hours. To reduce false positives, which of the following configurations should the analyst apply?
⚠ Common exam trap
A common mix-up: candidates confuse alert suppression (which reduces duplicates) with alert threshold (which reduces false positives by requiring multiple occurrences), leading them to choose options like D that manage alert volume but do not filter out low-confidence events.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Set the alert threshold to 5 occurrences within the query lookback period.
Setting an alert threshold (e.g., 5 occurrences within the query lookback period) reduces false positives by requiring the anomalous behavior to be persistent rather than a single outlier. In Microsoft Sentinel, the alert threshold filters out noise from occasional legitimate logins that might accidentally fall outside business hours or the known IP range, ensuring the rule only fires when the pattern is repeated enough to indicate a real threat.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Set the alert threshold to 5 occurrences within the query lookback period.
Why this is correct
Setting the alert threshold to 5 occurrences within the query lookback period directly addresses false positives by requiring a minimum number of matching events before an alert is created. In a Sentinel scheduled query rule, the threshold is evaluated against the number of rows returned by the query each run; lone anomalous but benign logins will fall below the threshold and be ignored. This is the most effective option because it manipulates the rule's triggering criterion, which is exactly what suppresses low-signal events.
- ✗
Enable entity mapping for the user account to correlate with other data sources.
Why it's wrong here
Enabling entity mapping for the user account enriches an alert with context such as account SID, SAM, and UPN, and it powers investigation and UEBA correlations, but it does not change the conditions that cause an alert to fire. The query still alerts on any single matching event, so the same one-off benign login would generate the same false positive, now merely with more metadata. Entity mapping improves triage efficiency after detection, not detection precision before the alert is created.
- ✗
Increase the query scheduling frequency to every 5 minutes from every hour.
Why it's wrong here
Increasing the query scheduling frequency from hourly to every 5 minutes makes the rule evaluate more often but does not alter the number of events needed to trigger an alert. Unless the query lookback period is also shortened, the same set of events may be evaluated repeatedly, causing duplicate alerts for the same underlying activity rather than filtering out single benign events. It also increases resource consumption in the Log Analytics workspace, so it is neither precise nor efficient for reducing false positives.
- ✗
Group all events into a single alert and set the suppression limit to 1 hour.
Why it's wrong here
Grouping all events into a single alert merely changes how many matches are aggregated in one alert, such as using the 'Group all events into a single alert' setting, but it still fires whenever at least one matching event is found. Adding a suppression period of 1 hour after an alert would pause all subsequent alerts from this rule, which can hide legitimate subsequent attacks and is not a true threshold mechanism. Consequently, this approach neither filters low-occurrence outliers nor preserves visibility into genuine threats.
Go deeper
Related to this question
About these practice questions
This SC-200 question is part of Courseiva's 209-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.