mediumMultiple ChoiceObjective-mapped
SC-200 A SOC team uses Microsoft Sentinel Practice Question
A SOC team uses Microsoft Sentinel. They need to correlate syslog events from on-premises firewalls with Microsoft Entra ID sign-in logs to detect VPN-based intrusions. The correlation requires joining two tables (Syslog and SigninLogs) on a common field (IP address) and running on a 10-minute schedule. Which type of analytics rule should the analyst configure?
⚠ Common exam trap
Many candidates confuse NRT rules with scheduled rules, but NRT rules cannot perform multi-table joins, which is explicitly required by the question's correlation of Syslog and SigninLogs.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Scheduled query rule
A scheduled query rule is correct because the requirement involves joining two tables (Syslog and SigninLogs) on a common field (IP address) and running on a 10-minute schedule. Scheduled query rules are designed for complex, multi-table correlations that run at fixed intervals (e.g., every 10 minutes) and can aggregate or join data across tables, making them ideal for this VPN intrusion detection scenario.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Scheduled query rule
Why this is correct
Scheduled query rules are the correct choice for correlating Syslog with other data sources because they accept fully custom KQL queries that can join, union, or aggregate multiple tables. You can schedule the query to run at any interval and define alert logic that matches your correlation criteria, such as joining Syslog and CommonSecurityLog on hostname or source IP. The alert generated includes the full query results, enabling analysts to investigate both sides of the correlation directly from the incident.
- ✗
Near-real-time (NRT) rule
Why it's wrong here
Near-real-time (NRT) rules are built for low-latency detection and execute approximately every minute, but they restrict query complexity to a limited set of KQL operators and support only a single data table. NRT rules do not permit multi-table joins, which immediately rules them out for correlating Syslog with other sources. They are best suited for simple threshold or pattern detections on one table, not for cross-source correlation.
- ✗
Fusion rule
Why it's wrong here
Fusion rules are Microsoft's prebuilt analytics that use machine learning to combine alerts across multiple security products into a multi-stage attack narrative. They are not customizable with KQL, nor do they allow you to define your own raw data sources or join logic. Since the question requires correlating Syslog data explicitly, a Fusion rule cannot be adapted to that purpose—you would be limited to the predefined alert-correlation patterns Microsoft provides.
- ✗
Anomaly rule
Why it's wrong here
Anomaly rules in Microsoft Sentinel are powered by built-in machine learning models that analyze temporal patterns in specific data sources to identify deviations from established baselines. They are not designed for custom KQL correlation logic, so you cannot write a query that joins Syslog with other tables like SecurityEvent or CommonSecurityLog. Because the underlying ML models and data source selections are predefined, anomaly rules cannot fulfill a requirement to correlate raw syslog events with additional signals across multiple tables.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SC-200 question from scratch — 209 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.