- A
SecurityEvent | where EventID in (4728, 4732) | where TargetAccount contains 'Domain Admins'
EventIDs 4728 and 4732 log member additions to security groups. Filtering by TargetAccount containing the group name isolates the desired group.
- B
SecurityEvent | where EventID == 4624 | where Account contains 'Admin'
Why wrong: EventID 4624 is for successful logon, not group membership changes.
- C
SecurityEvent | where EventID == 4738 | where TargetAccount contains 'Domain Admins'
Why wrong: EventID 4738 logs changes to user accounts (e.g., password reset, account enable), not group membership.
- D
SecurityEvent | where EventID == 4670 | where ObjectName contains 'Domain Admins'
Why wrong: EventID 4670 logs permissions changes on objects, not group membership addition.
Quick Answer
The answer is the KQL query SecurityEvent | where EventID in (4728, 4732) | where TargetAccount contains 'Domain Admins' because it directly filters for the two specific Windows Security Event IDs that log when a user is added to a security-enabled global or local group, and then narrows the results to the sensitive group name using the TargetAccount field. This query correctly detects user added to sensitive AD group activity by targeting the exact events generated by the Azure Monitor Agent from domain controllers, which is the core requirement for the scheduled analytics rule. On the SC-200 exam, this tests your ability to map real-world detection scenarios to the correct KQL operators and event IDs, with a common trap being the misuse of Account or MemberName instead of TargetAccount, or forgetting to include both 4728 and 4732. A helpful memory tip is to remember that for group membership changes, the TargetAccount holds the group name, while Account holds the user being added—so think “Target is the group, Account is the user.”
SC-200 Mitigate threats using Microsoft Sentinel Practice Question
This SC-200 practice question tests your understanding of mitigate threats using microsoft sentinel. Match the stated requirement to the specific cloud service, access model, or configuration option — many options are valid in isolation but not for this scenario. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A SOC team uses Microsoft Sentinel and ingests Windows Security Events from domain controllers using the Azure Monitor Agent (AMA). They want to create a scheduled analytics rule that generates an incident when a user account is created in a sensitive Active Directory group (e.g., Domain Admins) outside of approved change windows (e.g., after 9 PM). The required event IDs are 4728 (member added to security-enabled global group) and 4732 (member added to security-enabled local group). Which KQL query should the analyst use to filter for these specific events and the targeted group?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
SecurityEvent | where EventID in (4728, 4732) | where TargetAccount contains 'Domain Admins'
Option A is correct because it uses the `SecurityEvent` table with the `EventID` filter for 4728 and 4732, which are the exact event IDs for member additions to security-enabled global and local groups. The `TargetAccount` field contains the name of the group being modified, so filtering for 'Domain Admins' correctly identifies when a user is added to that sensitive group. This query directly matches the requirement to detect account creation in a sensitive AD group outside approved change windows.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
SecurityEvent | where EventID in (4728, 4732) | where TargetAccount contains 'Domain Admins'
Why this is correct
EventIDs 4728 and 4732 log member additions to security groups. Filtering by TargetAccount containing the group name isolates the desired group.
Related concept
Read the scenario before looking for a memorised answer.
- ✗
SecurityEvent | where EventID == 4624 | where Account contains 'Admin'
Why it's wrong here
EventID 4624 is for successful logon, not group membership changes.
- ✗
SecurityEvent | where EventID == 4738 | where TargetAccount contains 'Domain Admins'
Why it's wrong here
EventID 4738 logs changes to user accounts (e.g., password reset, account enable), not group membership.
- ✗
SecurityEvent | where EventID == 4670 | where ObjectName contains 'Domain Admins'
Why it's wrong here
EventID 4670 logs permissions changes on objects, not group membership addition.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates often confuse EventID 4738 (user account changed) or 4624 (logon) with group membership events, or they incorrectly assume the TargetAccount field contains the user account being added rather than the group name.
Detailed technical explanation
How to think about this question
Event IDs 4728 and 4732 are generated by the Security Account Manager (SAM) on domain controllers when a member is added to a security-enabled global or local group, respectively. The `TargetAccount` field in the SecurityEvent schema stores the name of the group being modified, not the user being added, which is a common point of confusion. In a real-world scenario, the analyst would also need to add a time filter (e.g., `| where TimeGenerated >= datetime(21:00:00)`) to enforce the approved change window restriction.
KKey Concepts to Remember
- Read the scenario before looking for a memorised answer.
- Find the constraint that changes the correct option.
- Eliminate answers that are true in general but not in this case.
TExam Day Tips
- Watch for words such as best, first, most likely and least administrative effort.
- Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A media company stores terabytes of video archives that are accessed once a year for audit purposes. Moving these objects to a cold storage tier (Azure Archive, S3 Glacier, or Google Nearline) costs a fraction of hot storage. Questions like this test whether you understand storage tiers, access frequency tradeoffs, and retrieval latency requirements.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
- →
Mitigate threats using Microsoft Sentinel — study guide chapter
Learn the concepts, then practise the questions
- →
Mitigate threats using Microsoft Sentinel practice questions
Targeted practice on this topic area only
- →
All SC-200 questions
1,639 questions across all exam domains
- →
Microsoft Security Operations Analyst SC-200 study guide
Full concept coverage aligned to exam objectives
- →
SC-200 practice test guide
How to use practice tests most effectively before exam day
Related practice questions
Related SC-200 practice-question pages
Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.
Manage a security operations environment practice questions
Practise SC-200 questions linked to Manage a security operations environment.
Respond to security incidents practice questions
Practise SC-200 questions linked to Respond to security incidents.
Perform threat hunting practice questions
Practise SC-200 questions linked to Perform threat hunting.
Mitigate threats using Microsoft Defender XDR practice questions
Practise SC-200 questions linked to Mitigate threats using Microsoft Defender XDR.
Mitigate threats using Microsoft Defender for Cloud practice questions
Practise SC-200 questions linked to Mitigate threats using Microsoft Defender for Cloud.
Mitigate threats using Microsoft Sentinel practice questions
Practise SC-200 questions linked to Mitigate threats using Microsoft Sentinel.
SC-200 fundamentals practice questions
Practise SC-200 questions linked to SC-200 fundamentals.
SC-200 scenario practice questions
Practise SC-200 questions linked to SC-200 scenario.
SC-200 troubleshooting practice questions
Practise SC-200 questions linked to SC-200 troubleshooting.
Practice this exam
Start a free SC-200 practice session
Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.
FAQ
Questions learners often ask
What does this SC-200 question test?
Mitigate threats using Microsoft Sentinel — This question tests Mitigate threats using Microsoft Sentinel — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: SecurityEvent | where EventID in (4728, 4732) | where TargetAccount contains 'Domain Admins' — Option A is correct because it uses the `SecurityEvent` table with the `EventID` filter for 4728 and 4732, which are the exact event IDs for member additions to security-enabled global and local groups. The `TargetAccount` field contains the name of the group being modified, so filtering for 'Domain Admins' correctly identifies when a user is added to that sensitive group. This query directly matches the requirement to detect account creation in a sensitive AD group outside approved change windows.
What should I do if I get this SC-200 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jun 11, 2026
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.