mediumMultiple ChoiceObjective-mapped
SC-200 Practice Question: A SOC analyst needs to create an analytics rule…
A SOC analyst needs to create an analytics rule in Microsoft Sentinel that triggers when a user logs in from an IP address outside of the organization's typical geographic locations, based on a learned baseline. Which type of analytics rule is best suited for this scenario?
⚠ Common exam trap
A common mix-up: candidates confuse Anomaly rules with Scheduled rules, thinking a scheduled query with a geographic filter (e.g., 'where ip_geo not in allowed list') can achieve the same result, but they miss that Anomaly rules dynamically learn and adapt the baseline without manual maintenance of allowed location lists.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Anomaly rule
An Anomaly rule in Microsoft Sentinel uses machine learning to establish a baseline of normal user behavior, such as typical geographic login locations. When a login event deviates from that learned baseline (e.g., from an unusual IP address outside the expected regions), the rule triggers an alert. This is the only rule type specifically designed for behavior-based anomaly detection without requiring static thresholds or predefined patterns.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Scheduled rule
Why it's wrong here
Scheduled rules execute a KQL query at fixed intervals, such as every 5 minutes or hourly, and compare results against static thresholds defined in the query. They lack a learning phase or adaptive baseline, so they would require manually pre-defining what constitutes a normal sign-in location for every user, which is impractical for dynamic behavioral patterns. Consequently, they cannot autonomously detect unusual sign-in locations that deviate from an established baseline.
- ✗
NRT (Near-Real-Time) rule
Why it's wrong here
Near-Real-Time (NRT) rules provide low-latency detection, typically querying data every minute, but they rely on static detection logic like pattern matching or fixed thresholds. They do not employ machine learning to establish a baseline of normal user sign-in behavior, so they would miss novel or evolving location anomalies that differ from historical patterns. The minimal delay in data processing does not compensate for the absence of adaptive learning, making NRT rules unsuitable for this scenario.
- ✓
Anomaly rule
Why this is correct
Anomaly rules in Microsoft Sentinel leverage built-in machine learning models to learn the baseline of normal sign-in behavior for users and entities over a specified time window. They then flag sign-in events that deviate significantly from that learned baseline, such as sign-ins from geographically unusual locations, impossible travel, or previously unseen IP addresses. This adaptive, self-learning approach eliminates the need for manually configured thresholds, making anomaly rules the appropriate choice for detecting unusual sign-in locations.
- ✗
Fusion rule
Why it's wrong here
Fusion rules are designed to correlate multiple security alerts and signals across various data sources to detect multi-stage attacks or kill chains, such as an initial compromise leading to lateral movement and data exfiltration. A single anomalous sign-in location represents an individual event, not a chain of correlated activities, so Fusion would not have enough context to trigger. Additionally, Fusion does not learn a personalized baseline for normal sign-in behavior; it relies on aggregating existing alerts, making it unsuitable for this single-event anomaly detection requirement.
Go deeper
Related to this question
About these practice questions
This SC-200 question is part of Courseiva's 209-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.