mediumMultiple Choice
SC-200 Practice Question: A SOC analyst needs to create a Microsoft…
A SOC analyst needs to create a Microsoft Sentinel scheduled analytics rule that detects a potential brute-force attack. The rule should alert when a single IP address attempts to sign in to more than 10 different user accounts within 5 minutes. The data is in the 'SigninLogs' table. Which KQL operator should the analyst use to count distinct users per IP address per 5-minute time window?
⚠ Common exam trap
A common mix-up: candidates confuse `count()` (total events) with `dcount()` (distinct values), leading candidates to pick Option B, which would count repeated attempts to the same user as separate events and miss the distinct-user threshold required for a brute-force detection.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
summarize dcount(UserPrincipalName) by IPAddress, bin(TimeGenerated, 5m)
The requirement is to count distinct user accounts per IP address within a 5-minute window. The `dcount()` function estimates the number of distinct values of `UserPrincipalName`, `bin(TimeGenerated, 5m)` groups the logs into 5-minute buckets, and `summarize ... by IPAddress` ensures the count is per source IP. This directly matches the brute-force detection logic of more than 10 distinct users from a single IP in 5 minutes.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
summarize dcount(UserPrincipalName) by IPAddress, bin(TimeGenerated, 5m)
Why this is correct
This is correct because dcount(UserPrincipalName) computes a distinct count of user accounts, which directly answers how many different users attempted sign-ins. Grouping by IPAddress and bin(TimeGenerated, 5m) segments the data into fixed 5-minute windows per source IP, allowing the rule to detect sudden spikes in unique accounts from a single IP—a classic brute-force or password-spray signature. The bin function ensures temporal alignment across events, so aggregation is performed over consistent time slices rather than ad-hoc intervals.
- ✗
summarize count(UserPrincipalName) by IPAddress
Why it's wrong here
This is wrong because count() tallies every individual event, not unique users. If one UserPrincipalName appears multiple times in the log (e.g., retries or repeated failed attempts), it inflates the result, making a single user look like many distinct accounts. Additionally, without a bin(TimeGenerated, ...) clause, the aggregation spans all time, so it cannot detect short-duration anomalies like a burst of logins from one IP within 5 minutes—it would only produce a historical total.
- ✗
summarize dcount(IPAddress) by UserPrincipalName, bin(TimeGenerated, 5m)
Why it's wrong here
This is wrong because it reverses the semantic: it counts distinct IPAddresses per UserPrincipalName, which answers 'how many source IPs did each user authenticate from?' rather than 'how many users came from each IP?'. That pattern is useful for detecting impossible travel or account compromise (one user hopping across many IPs), but it does not address the requirement of finding many unique accounts from a single IP. The 5-minute bin is applied, but the dimension and measure are swapped, so the result is the opposite of what the analyst needs.
- ✗
make-set(UserPrincipalName) by IPAddress
Why it's wrong here
This is wrong because make-set() returns an array (a set) of distinct UserPrincipalName values, not a numeric count. While it does de-duplicate users, an array cannot be directly compared against a numeric threshold in a Sentinel alert rule without additional processing such as array_length(). Moreover, there is no bin(TimeGenerated, ...) grouping, so the set would accumulate every user ever seen from that IP indefinitely, making it impossible to isolate activity within a 5-minute window and causing memory and performance overhead on large datasets.
Go deeper
Related to this question
About these practice questions
This SC-200 question is part of Courseiva's 1,303-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.