SC-200 Manage a security operations environment Practice Question
Your team uses Microsoft Sentinel to investigate incidents. You need to create a custom analytic rule that triggers an incident when a user signs in from an unfamiliar location. What is the most efficient way to achieve this?
⚠ Common exam trap
It's easy for candidates to assume a custom KQL query (Option B) is the most flexible and efficient approach, overlooking that Sentinel's built-in templates are pre-optimized and require no manual logic for defining 'unfamiliar' locations.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use a built-in Anomalous Sign-in Location rule template.
Microsoft Sentinel provides a built-in 'Anomalous Sign-in Location' rule template that leverages Microsoft Entra ID Identity Protection data to detect sign-ins from unfamiliar locations. This template is pre-configured with the necessary KQL logic and alerting, making it the most efficient method without requiring custom development or additional data sources.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a playbook triggered by Microsoft Entra ID alerts.
Why it's wrong here
A playbook is an automated response workflow, not a detection rule. While Microsoft Entra ID alerts can trigger a playbook to remediate an already-detected issue, creating a playbook does not generate new detections or identify anomalous sign-in locations. To detect the anomaly itself, you need an analytics rule that processes data and creates an alert, which can then optionally invoke a playbook.
- ✗
Write a custom KQL query using SigninLogs.
Why it's wrong here
Writing a custom KQL query against SigninLogs is technically feasible, but it requires significantly more effort and expertise than using a built-in template. You would need to define the anomaly logic, set thresholds, handle false positives, and map entities manually. The built-in Anomalous Sign-in Location rule leverages UEBA and built-in machine learning models, providing a ready-made, optimized detection without the need to tune a custom query.
- ✗
Configure a Microsoft Purview insider risk policy.
Why it's wrong here
Microsoft Purview insider risk policies are designed to detect potential insider threats such as data exfiltration, risky user activities, or policy violations, not external sign-in anomalies. They rely on different data sources and signals, like endpoint activity and Microsoft 365 audit logs, rather than Entra ID sign-in telemetry. Therefore, configuring an insider risk policy would not address the requirement of detecting anomalous sign-in locations.
- ✓
Use a built-in Anomalous Sign-in Location rule template.
Why this is correct
The built-in Anomalous Sign-in Location rule template in Microsoft Sentinel is the most direct solution. It uses Microsoft Sentinel's UEBA (User and Entity Behavior Analytics) to baseline user behavior and flag sign-ins from unusual geographic locations or IP addresses. This template is ready to enable, requires no custom KQL, and automatically maps entities and generates alerts that feed into incidents—exactly what is needed for investigating sign-in anomalies.
Go deeper
Related to this question
About these practice questions
One of 673 original SC-200 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.