SC-200 Manage a security operations environment Practice Question
Your organization uses Microsoft Sentinel and has enabled UEBA. A security analyst observes that a user account with no prior administrative activity performed a high volume of Azure Resource Manager operations. The analyst wants to investigate further. Which Microsoft Sentinel feature should the analyst use to quickly identify if this behavior is anomalous based on the user's historical profile?
⚠ Common exam trap
It's easy for candidates to confuse UEBA with Analytics rules, assuming that any detection must come from a rule, but UEBA is specifically designed for behavior-based anomaly detection against a user's own historical baseline, not signature-based or rule-based detection.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
User and Entity Behavior Analytics (UEBA)
UEBA is the correct feature because it builds a behavioral baseline for each user over time, including typical Azure Resource Manager activity patterns. When a user with no prior administrative history suddenly performs a high volume of ARM operations, UEBA can flag this as anomalous by comparing the current activity against the user's historical profile, surfacing the deviation in the UEBA investigation pane without requiring custom query creation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Hunting queries
Why it's wrong here
Hunting queries are proactive, investigator-driven KQL searches executed in the Sentinel Logs blade to uncover suspicious activity, but they operate against ingested raw data at query time rather than referencing a persisted machine-learning baseline of each user's historical behavior. While you could write a query that manually compares current activity to a stored profile, the feature itself does not automatically derive or apply user-specific behavioral baselines, so it is not the mechanism that provides UEBA's built-in anomaly detection.
- ✗
Workbooks
Why it's wrong here
Workbooks are interactive dashboards that visualize Sentinel data using KQL queries and tiles, enabling analysts to explore trends, counts, and entity timelines. They can display UEBA baseline data if explicitly queried, but they have no detection engine and do not evaluate events against historical user profiles to generate alerts or anomalies; their role is presentation and investigation support, not autonomous behavioral analysis based on established baselines.
- ✓
User and Entity Behavior Analytics (UEBA)
Why this is correct
User and Entity Behavior Analytics (UEBA) is the correct capability because it uses machine learning models to build a personalized historical baseline for each user and entity—such as typical logon times, locations, and performed actions—then continuously scores new activities against that profile to identify anomalous behavior automatically in Sentinel. UEBA's anomaly detections are surfaced as suspicious activities or incidents and feed into the entity timeline, requiring no custom rule authoring to compare current events to the user's own established patterns.
- ✗
Analytics rules
Why it's wrong here
Analytics rules are scheduled or Microsoft Security incident creation rules that detect threats based on KQL queries and alert thresholds, allowing custom detection logic. However, they only evaluate the specific conditions and time windows you define in the rule's query; they do not intrinsically access or compare against an entity's machine-learned historical profile unless you explicitly build that comparison into the rule (which is cumbersome and not automatic). Therefore, analytics rules alone do not provide the out-of-the-box UEBA behavior that establishes baselines and flags anomalies relative to a user's own patterns.
Go deeper
Related to this question
About these practice questions
This SC-200 question is part of Courseiva's 209-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.