SC-200 Practice Question: An SOC analyst wants to quickly enable detection…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Scheduled

  Why this is correct

  The 'Scheduled' analytics rule template is correct because it periodically executes a KQL query against Microsoft Entra ID audit data (AuditLogs or AzureADAuditLogs) to detect deterministic events, such as a user being added to the Global Administrator role. You control the schedule and query, enabling immediate detection without dependency on external signal correlation. This direct query-and-alert pattern is exactly how the built-in Global Admin role addition template works.

• ✗

  Microsoft Security

  Why it's wrong here

  Microsoft Security analytics rule templates are designed to create incidents from alerts already produced by Microsoft security services, like Microsoft Defender for Cloud or Defender for Identity, via connected data connectors. They do not run custom KQL queries against raw Microsoft Entra ID audit logs, so they cannot natively detect a specific role-add event. Therefore, choosing this template will not surface the Global Administrator assignment as a generated incident.

• ✗

  Fusion

  Why it's wrong here

  The Fusion detection relies on a sophisticated, built-in correlation engine that combines multiple security signals from various sources to identify multistage attacks, such as IOT-based ransomware or defense evasion. It requires high-fidelity alerts and contextual relationships across different data types; a simple, single log event like a member added to a privileged role does not provide the multi-signal complexity Fusion is designed for. Thus, Fusion cannot be used to enable this specific deterministic detection.

• ✗

  Machine Learning (ML)

  Why it's wrong here

  ML-based analytics rules leverage statistical anomaly detection algorithms that establish baseline behaviors and then flag deviations, such as unusual sign-in times or impossible travel, making them unsuitable for rule-based, exact-match detections like a role addition. A Global Administrator assignment is a specific, deterministic event that should be caught by a precise query rather than an algorithm that needs training data and threshold tuning. Also, ML templates are typically less transparent and slower to surface deterministic security controls than scheduled queries.