SC-200 Practice Question: A SOC analyst is configuring a Microsoft Sentinel…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Scheduled

  Why it's wrong here

  A scheduled analytics rule runs a KQL query on a fixed interval (for example, every 5 minutes) against a configured data table and creates an incident only if the query result count exceeds a set threshold. The logic is purely deterministic and threshold-based; it has no machine-learning component that learns from historical behavior. Therefore scheduled rules are unsuitable when the requirement is to detect rare or unknown operations that do not match a predefined query pattern.

• ✗

  Microsoft Security Incident (for using existing alert triggers)

  Why it's wrong here

  The Microsoft Security Incident rule type is a connector-based analytics rule that watches alerts generated by other Microsoft security products—like Microsoft Defender for Endpoint, Defender for Identity, or Defender for Office 365—and automatically groups them into incidents. It does not run KQL against raw data sources, nor does it apply any machine-learning anomaly detection; it merely correlates and ingests existing security alerts. Thus it is not the right choice for applying ML models to raw data to find rare operations.

• ✓

  Anomaly detection

  Why this is correct

  Anomaly detection rules in Microsoft Sentinel apply trained machine-learning models to establish a baseline of normal behavior for entities, users, or hosts and then flag events that deviate significantly from that baseline. These rules use built-in anomaly templates (such as unusual sign-in or anomalous privilege use) or custom ML models, making them specifically designed to detect rare, unusual operations that would never meet a static threshold. This matches the requirement for detecting rare operations without writing a fixed query.

• ✗

  NRT (Near-Real-Time)

  Why it's wrong here

  Near-real-time (NRT) rules run KQL queries every minute with a low-latency window (often within 1 minute) to produce alerts on recent data, but the detection logic is still a static query with no machine-learning baseline. NRT rules are useful for immediate alerting on known patterns or thresholds, not for discovering anomalous behavior that only becomes apparent through historical context. Since the requirement is ML-based detection of rare operations, NRT is not applicable.

Go deeper

Related to this question