SC-200 Perform threat hunting Practice Question
Your threat hunting hypothesis is that a user's credentials were used to sign in from two geographically distant locations within a short time. In Microsoft Defender for Cloud Apps, which log type would you query in Microsoft Sentinel to detect impossible travel?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
SigninLogs
SigninLogs contain user sign-in activities with IP address and timestamp, essential for detecting impossible travel.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
SigninLogs
Why this is correct
SigninLogs record user sign-in events with location and time.
- ✗
AuditLogs
Why it's wrong here
AuditLogs track administrative changes, not user sign-ins.
- ✗
CommonSecurityLog
Why it's wrong here
CommonSecurityLog is for on-premises security appliances, not cloud sign-ins.
- ✗
OfficeActivity
Why it's wrong here
OfficeActivity logs user actions in Microsoft 365, but not sign-in location details.
Go deeper
Related to this question
About these practice questions
One of 209 original SC-200 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.