SC-200 Respond to security incidents Practice Question
Your organization uses Microsoft Sentinel. You have a scheduled analytics rule that queries Windows Security Events to detect local admin group modifications. The rule runs every hour and looks back 1 hour. However, you are missing events that occur within the first few minutes of the hour. What is the most likely cause?
⚠ Common exam trap
Candidates often assume ingestion delay or query period length is the cause, but the real issue is time zone mismatch between event timestamps and the query's UTC-based lookback window.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The event time is in local time, and the query uses UTC, causing events near the boundary to be excluded.
The scheduled analytics rule uses a lookback period of 1 hour, but if the event time is stored in local time while the query uses UTC, events near the hour boundary can be excluded due to time zone offset. Microsoft Sentinel stores events in UTC by default, and the query's time filter (e.g., 'TimeGenerated > ago(1h)') compares against UTC timestamps. If the Windows Security Events are logged in local time and not converted, events occurring just after the hour in local time may fall outside the UTC lookback window, causing them to be missed.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The event time is in local time, and the query uses UTC, causing events near the boundary to be excluded.
Why this is correct
Sentinel stores and queries timestamps in UTC, while Windows event logs record event time in the machine's local time zone. When an analytics rule uses a local-time field (such as EventTime or TimeCreated) for the where clause, events occurring in the last few minutes of the lookback window can be shifted outside the UTC-based query boundary, so the rule misses them even though they occurred within the intended hour. The fix is to convert time fields to UTC (e.g., using `datetime_utc()` or comparing against UTC datetime literals) or rely on `TimeGenerated`, which is always UTC.
- ✗
The query period is too short; it should be 2 hours.
Why it's wrong here
The default 1-hour query period is perfectly adequate to capture any event that actually occurred within that hour; extending it to 2 hours would only search older data and does not address why an event near the current boundary was missed. The real cause is a timestamp misalignment—the event was logged in local time but the rule's window is computed in UTC—not the length of the lookback. In fact, a longer period could mask the boundary issue but would not fix the fundamental time zone mismatch.
- ✗
The rule is using 'Last activity' instead of 'TimeGenerated'.
Why it's wrong here
Analytics rules should always filter on `TimeGenerated`, Sentinel's ingestion timestamp, which is stored in UTC and aligns exactly with the rule's query window. 'Last activity' is not a standard Sentinel column and, if used, would likely refer to a custom field from a specific data source; either way, changing the time column would not resolve the UTC-versus-local-time discrepancy described. The root problem is that the event's underlying local timestamp is being compared to UTC boundaries, not that the rule references the wrong column name.
- ✗
There is a 5-minute ingestion delay for Windows events.
Why it's wrong here
Windows events collected by the Log Analytics agent or AMA are typically ingested within a few seconds, and Sentinel's scheduled rules automatically account for short ingestion delays by adding a small buffer when running the query. A persistent 5-minute delay would affect only events that were still arriving at query time, not events that are clearly older and already visible in Log Analytics when you manually investigate. The boundary exclusion is caused by a time-zone conversion error, not by a delay in data ingestion.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SC-200 question from scratch — 1,303 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.