SC-200 Respond to security incidents Practice Question
You are investigating a suspicious sign-in to a privileged account. You need to determine if the sign-in was from a known malicious IP address. Which Microsoft Sentinel data source should you query?
⚠ Common exam trap
SC-200 often tests the confusion between sign-in logs (which show the IP) and threat intelligence indicators (which classify the IP as malicious); candidates pick SigninLogs thinking it contains reputation data.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
ThreatIntelligenceIndicator
The ThreatIntelligenceIndicator table in Microsoft Sentinel stores threat intelligence indicators (IPs, domains, URLs, file hashes) imported from TI providers or uploaded via API. To determine if a sign-in originated from a known malicious IP, you query this table for the IP address and check for matches.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
ThreatIntelligenceIndicator
Why this is correct
ThreatIntelligenceIndicator tables store ingested threat indicators, including malicious IP addresses, matched against your environment. Querying it lets you confirm whether the sign-in's source IP appears in known threat intelligence, directly satisfying the requirement to identify a known malicious IP address rather than relying on sign-in logs alone.
- ✗
SecurityEvent
Why it's wrong here
SecurityEvent carries Windows agent telemetry such as logon events (4624/4625) from onboarded hosts, not cloud authentication records. It suits investigating local or domain logons on a server, but a Microsoft Entra ID privileged sign-in is not captured there.
- ✗
SigninLogs
Why it's wrong here
SigninLogs records authentication events and location data, not the threat intelligence IP indicators needed to confirm malicious reputation. It is tempting because the suspicious sign-in itself lives there, and it would be the right source for reviewing the authentication attempt, but matching the IP against known-bad feeds requires ThreatIntelligenceIndicator.
- ✗
AuditLogs
Why it's wrong here
AuditLogs holds Microsoft Entra ID directory change events such as role assignments and policy edits, not authentication attempts. It is queried when tracing who modified a privileged role, whereas identifying a malicious source IP requires the sign-in event records themselves.
Go deeper
Related to this question
About these practice questions
This SC-200 question is part of Courseiva's 1,303-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.