Quick Answer
The answer is that the alert suppression threshold is configured too high. This is the most likely cause because a custom detection rule in Microsoft Defender XDR uses an alert suppression threshold to prevent alert fatigue—it only generates an alert when the number of results from your KQL query exceeds that threshold. If the threshold is set too high, even though the query runs correctly and returns valid data, the count of matching events may fall below that limit, causing the rule to stop generating alerts entirely. On the SC-200 exam, this scenario tests your understanding of how alert suppression interacts with custom detection rules; a common trap is to assume the query or data pipeline is broken when the real issue is a misconfigured threshold. Remember the memory tip: “Suppress the noise, not the signal”—if alerts stop, check your threshold count before blaming the query.
This SC-200 practice question tests your understanding of manage a security operations environment. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
Your security team uses Microsoft Defender XDR to investigate incidents. You have a custom detection rule that runs a KQL query every hour. Recently, the rule stopped generating alerts. You verify that the query syntax is correct and that data is being ingested. What is the most likely cause?
Clue words in this question
Noticing these words before you look at the options changes how you read each choice.
Clue: "most likely"
Why it matters: Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.
The alert suppression threshold is configured too high.
Suppression may prevent alerts from being generated.
The Microsoft Defender XDR license has expired.
Why wrong: All rules would stop, not just one.
An automation rule is deleting the alerts.
Why wrong: Automation rules act after alert creation, not prevent it.
The query is not returning any results.
Why wrong: If no results, no alert, but the user says data is ingested.
Answer choices
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
The alert suppression threshold is configured too high.
The custom detection rule uses an alert suppression threshold, which prevents alerts from being generated unless the query results exceed a specified count. If this threshold is set too high, the rule may stop generating alerts even though the query returns valid results, because the number of matching events no longer meets the suppression limit. This is the most likely cause given that the query syntax is correct and data is being ingested.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
For each option: why learners choose it and why it is or isn't the right answer here.
The alert suppression threshold is configured too high.
Why this is correct
Suppression may prevent alerts from being generated.
Clue confirmation
The clue word "most likely" in the question point toward this answer.
Related concept
Read the scenario before looking for a memorised answer.
The Microsoft Defender XDR license has expired.
Why it's wrong here
All rules would stop, not just one.
An automation rule is deleting the alerts.
Why it's wrong here
Automation rules act after alert creation, not prevent it.
The query is not returning any results.
Why it's wrong here
If no results, no alert, but the user says data is ingested.
Common exam traps
The trap here is that candidates often assume a query returning no results (Option D) is the cause, but the question explicitly confirms data ingestion and correct syntax, so the issue is more likely a misconfigured suppression threshold that silently drops alerts.
Detailed technical explanation
Alert suppression thresholds in custom detection rules are defined using the `| where` clause or by setting a minimum result count in the rule configuration. Under the hood, the KQL query runs, and if the number of results is below the threshold, the rule suppresses the alert entirely, even if the query returns some data. In real-world scenarios, this can happen when a previously noisy query is tuned with a high threshold to reduce false positives, but later the threat pattern changes, causing fewer matches, and the threshold inadvertently blocks legitimate alerts.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
A cloud solutions architect for a retail company is evaluating services for a new workload. The correct answer here reflects best practice for the specific scenario described — not a general cloud recommendation. Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option. Cloud exam questions reward reading the constraint carefully: the same technology can be right or wrong depending on the use case.
What to study next
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Manage a security operations environment — study guide chapter
Learn the concepts, then practise the questions
Manage a security operations environment practice questions
Targeted practice on this topic area only
All SC-200 questions
1,639 questions across all exam domains
Microsoft Security Operations Analyst SC-200 study guide
Full concept coverage aligned to exam objectives
SC-200 practice test guide
How to use practice tests most effectively before exam day
Related practice questions
Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.
Practise SC-200 questions linked to Manage a security operations environment.
Practise SC-200 questions linked to Respond to security incidents.
Practise SC-200 questions linked to Perform threat hunting.
Practise SC-200 questions linked to Mitigate threats using Microsoft Defender XDR.
Practise SC-200 questions linked to Mitigate threats using Microsoft Defender for Cloud.
Practise SC-200 questions linked to Mitigate threats using Microsoft Sentinel.
Practise SC-200 questions linked to SC-200 fundamentals.
Practise SC-200 questions linked to SC-200 scenario.
Practise SC-200 questions linked to SC-200 troubleshooting.
Practice this exam
Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.
FAQ
Manage a security operations environment — This question tests Manage a security operations environment — Read the scenario before looking for a memorised answer..
The correct answer is: The alert suppression threshold is configured too high. — The custom detection rule uses an alert suppression threshold, which prevents alerts from being generated unless the query results exceed a specified count. If this threshold is set too high, the rule may stop generating alerts even though the query returns valid results, because the number of matching events no longer meets the suppression limit. This is the most likely cause given that the query syntax is correct and data is being ingested.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Yes — watch for: "most likely". Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jun 25, 2026
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.