easyMultiple Choice
SC-200 Practice Question: An SOC analyst wants to quickly enable detection…
An SOC analyst wants to quickly enable detection for when a user account is added to the Global Administrator role in Microsoft Entra ID using a built-in analytics rule template in Microsoft Sentinel. Which type of analytics rule template should the analyst use?
⚠ Common exam trap
A common mix-up: candidates confuse 'Microsoft Security' rules (which handle alerts from other Microsoft services) with the ability to create custom detections from raw logs, but only Scheduled rules allow you to write your own KQL query against tables like AuditLogs.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Scheduled
The analyst should use a Scheduled analytics rule template because the detection for when a user account is added to the Global Administrator role in Microsoft Entra ID requires querying the AuditLogs table at a regular interval. Scheduled rules allow you to define a KQL query that runs on a schedule (e.g., every 5 minutes) and generates alerts based on the results. This is the only built-in rule type that supports custom log queries for specific activities like role assignments.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Scheduled
Why this is correct
The 'Scheduled' analytics rule template is correct because it periodically executes a KQL query against Microsoft Entra ID audit data (AuditLogs or AzureADAuditLogs) to detect deterministic events, such as a user being added to the Global Administrator role. You control the schedule and query, enabling immediate detection without dependency on external signal correlation. This direct query-and-alert pattern is exactly how the built-in Global Admin role addition template works.
- ✗
Microsoft Security
Why it's wrong here
Microsoft Security analytics rule templates are designed to create incidents from alerts already produced by Microsoft security services, like Microsoft Defender for Cloud or Defender for Identity, via connected data connectors. They do not run custom KQL queries against raw Microsoft Entra ID audit logs, so they cannot natively detect a specific role-add event. Therefore, choosing this template will not surface the Global Administrator assignment as a generated incident.
- ✗
Fusion
Why it's wrong here
The Fusion detection relies on a sophisticated, built-in correlation engine that combines multiple security signals from various sources to identify multistage attacks, such as IOT-based ransomware or defense evasion. It requires high-fidelity alerts and contextual relationships across different data types; a simple, single log event like a member added to a privileged role does not provide the multi-signal complexity Fusion is designed for. Thus, Fusion cannot be used to enable this specific deterministic detection.
- ✗
Machine Learning (ML)
Why it's wrong here
ML-based analytics rules leverage statistical anomaly detection algorithms that establish baseline behaviors and then flag deviations, such as unusual sign-in times or impossible travel, making them unsuitable for rule-based, exact-match detections like a role addition. A Global Administrator assignment is a specific, deterministic event that should be caught by a precise query rather than an algorithm that needs training data and threshold tuning. Also, ML templates are typically less transparent and slower to surface deterministic security controls than scheduled queries.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SC-200 question from scratch — 1,303 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.