Courseiva
← SC-200
Full test
Manage a security operations environment →easyMultiple ChoiceObjective-mapped

SC-200 Manage a security operations environment Practice Question

Exhibit

Refer to the exhibit.
```kusto
SigninLogs
| where TimeGenerated > ago(1d)
| where RiskLevelDuringSignIn == "high"
| where RiskLevelAggregated == "high"
| project UserPrincipalName, IPAddress, RiskLevelDuringSignIn, RiskLevelAggregated
| summarize count() by UserPrincipalName
| where count_ > 5
```

Refer to the exhibit. You have an analytics rule in Microsoft Sentinel that uses this KQL query. The rule is configured to run every hour and alert when the result count is greater than 0. Which type of attack is this rule most likely detecting?

⚠ Common exam trap

Many candidates confuse 'account takeover from a new location' (which requires a successful sign-in from an unfamiliar location) with 'brute force attack' (which is characterized by multiple failed sign-ins), leading them to pick Option C instead of D.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Brute force attack on user accounts

The KQL query counts failed sign-in events (ResultType != 0) aggregated by User, IPAddress, and a 5-minute bin, then filters for users with more than 10 failures. This pattern of multiple rapid failed logins from the same IP against a single user is the classic signature of a brute force attack, where an attacker tries many passwords to guess credentials. The rule triggers when the count exceeds 10 within any 5-minute window, making it highly specific to brute force detection.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • ✗

    Privileged account misuse

    Why it's wrong here

    Privileged account misuse would require evidence that accounts with elevated roles (e.g., Global Admin, Exchange Admin) performed actions exceeding their legitimate authorization, such as modifying MFA settings or creating backdoor accounts. The analytics rule's trigger is repeated high-risk sign-ins across many users, which does not isolate a specific privileged role's behavior and instead points to an attack against ordinary, non-privileged accounts.

  • ✗

    Data exfiltration via sign-in

    Why it's wrong here

    Data exfiltration via sign-in is a misclassification because the rule's data source is sign-in risk scores, which evaluate the likelihood that an authentication attempt is fraudulent—not whether data was viewed, copied, or transferred. True data exfiltration detection requires separate signals like abnormal download volumes from SharePoint, unusual outbound network flows, or DLP alerts. The exhibited rule lacks any such evidence, so while a brute-force attack could eventually lead to exfiltration, the sign-in pattern alone does not support this conclusion.

  • ✗

    Account takeover from a new location

    Why it's wrong here

    Account takeover from a new location describes a single suspicious authentication where a legitimate user logs in from an unfamiliar IP or geo-location, suggesting the attacker stole that user's credentials. In contrast, the exhibit shows multiple high-risk sign-in events, likely aggregated across several user accounts or repeated attempts against a set of accounts—this is inconsistent with a single account takeover and instead indicates a systemic brute-force operation.

  • ✓

    Brute force attack on user accounts

    Why this is correct

    A brute force attack on user accounts is the correct classification because high-risk sign-ins reflect patterns such as repeated failed password attempts, impossible travel across many accounts, or logins from known malicious IPs—all hallmarks of password guessing or credential stuffing. Sentinel analytics rules that aggregate risk signals from Microsoft Entra ID Protection will generate a single incident when multiple users experience elevated sign-in risk, which matches a coordinated brute-force or password-spray attack rather than a targeted compromise.

About these practice questions

Courseiva writes every SC-200 question from scratch — 673 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.