hardMultiple ChoiceObjective-mapped
SC-200 Practice Question: A SOC analyst creates a scheduled analytics rule…
A SOC analyst creates a scheduled analytics rule in Microsoft Sentinel that uses the following KQL query to detect impossible travel: SigninLogs | where TimeGenerated > ago(1d) | summarize Countries = make_set(Location) by UserPrincipalName | where array_length(Countries) > 1 However, the analyst notices that the rule generates too many false positives for users who travel legitimately. What is the best way to refine the rule to reduce false positives without missing actual impossible travel?
⚠ Common exam trap
A common mix-up: candidates think filtering by VPN or using aggregation functions like make_set or dcount() is sufficient, but they fail to recognize that impossible travel detection fundamentally requires a time-based correlation between geographically distinct sign-in events.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Modify the query to include a time difference condition using the partition operator or a join to find sign-ins from different countries within a short time window.
Impossible travel detection requires correlating sign-ins from different geographic locations within a time window that is too short for physical travel. By using the partition operator or a join to compare timestamps between sign-ins from different countries, the query can distinguish between legitimate sequential travel (e.g., a user flying from New York to London over 8 hours) and truly impossible simultaneous sign-ins (e.g., sign-ins from New York and London within 30 minutes). This reduces false positives while still catching actual impossible travel.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Add a condition to filter out VPN IP addresses from the Log Analytics workspace.
Why it's wrong here
Filtering VPN IP addresses from the Log Analytics workspace merely removes known VPN egress points from the data set; it does not constrain the time difference between successive sign-ins from geographically distant countries. An attacker using a VPN could still produce impossible travel, and a legitimate user can physically travel between countries within hours, so without a temporal comparison the rule will generate false positives. This approach also weakens the detection by discarding telemetry that might be useful for correlation.
- ✗
Instead of using make_set, use the dcount() function to estimate distinct countries.
Why it's wrong here
Switching from make_set() to dcount() changes only how distinct countries are approximated, providing a cardinality estimate rather than an exact list, but it still aggregates per user over the entire query window. Because dcount() operates on the whole set of sign-in events without evaluating timestamps for consecutive sign-ins, it cannot identify two countries visited within a short period. The core impossible-travel logic requires comparing event times pairwise, not counting distinct country values.
- ✗
Use the time series anomaly detection function series_decompose() on the signin data.
Why it's wrong here
series_decompose() is designed for anomaly detection on numeric time series, such as breaking down a metric into trend, seasonal, and residual components to spot unusual spikes or drops. Sign-in data with country fields is categorical and event-based, not a univariate numeric measure, so applying this function would not yield a location-transition comparison. It would at best flag unusual volume patterns, not the specific scenario of a user authenticating from two distant countries within minutes.
- ✓
Modify the query to include a time difference condition using the partition operator or a join to find sign-ins from different countries within a short time window.
Why this is correct
This is correct because it introduces the missing temporal constraint: by partitioning sign-ins by user (or self-joining the sign-in table), the query can sort events by timestamp and compute the time difference between consecutive sign-ins where the country changes. A threshold, for example less than 60 minutes for countries that are thousands of miles apart, makes the rule detect actual impossible travel rather than merely multiple countries in a day. The partition operator or join with a time-diff filter enables the scheduled analytics rule to alert only on geographically inconsistent rapid transitions.
Go deeper
Related to this question
About these practice questions
One of 209 original SC-200 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.