SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
A company uses Microsoft Sentinel as its SIEM. They need to create a custom analytics rule that runs every hour and queries for failed logins from a specific IP address. Which rule scheduling option should they configure?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Run every 1 hour with a 1-hour query period
To ensure the analytics rule captures all failed logins from the specified IP address that occur within the hour, the rule should be scheduled to run every 1 hour with a query period of 1 hour. This means each time the rule runs, it will query logs from the previous hour, covering the time since the last run. Options A and C have mismatched frequencies and query periods, and Option B runs too infrequently for hourly monitoring.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Run every 5 minutes with a 5-minute query period
Why it's wrong here
Configuring an analytics rule to run every 5 minutes with a 5-minute query period is generally too frequent for a standard hourly monitoring requirement. While this provides near real-time detection, it consumes more Log Analytics resources due to increased KQL query executions, potentially leading to higher costs. Unless the specific threat demands such rapid detection and the volume of events is extremely high, this configuration represents an inefficient use of resources and could contribute to alert fatigue if not carefully managed.
- ✗
Run every 24 hours with a 24-hour query period
Why it's wrong here
Setting an analytics rule to run every 24 hours with a 24-hour query period introduces a significant delay in threat detection. This daily execution schedule means that any security incident or anomalous activity could go unnoticed for up to a full day before an alert is generated. For a Security Information and Event Management (SIEM) system like Microsoft Sentinel, such a long detection latency is typically unacceptable, as it severely hinders timely incident response and increases the window of opportunity for attackers.
- ✗
Run every 1 hour with a 5-minute query period
Why it's wrong here
Running an analytics rule every 1 hour but only querying the last 5 minutes of data creates critical blind spots in security monitoring. This configuration would cause the rule to miss 55 minutes of data from each hourly cycle, as it only evaluates events that occurred within the most recent 5-minute window before execution. Consequently, most security incidents or anomalous activities happening outside that narrow 5-minute frame would go undetected, rendering the rule largely ineffective for comprehensive hourly monitoring.
- ✓
Run every 1 hour with a 1-hour query period
Why this is correct
This configuration is optimal for ensuring comprehensive hourly threat detection in Microsoft Sentinel. By running the analytics rule every hour and simultaneously querying the preceding 1-hour period, it guarantees that all relevant data generated within that timeframe is processed, preventing any data gaps. This balance between detection timeliness and resource utilization provides consistent and complete visibility into security events without excessive query frequency or unnecessary cost implications, aligning perfectly with a requirement for hourly monitoring.
Go deeper
Related to this question
Learn chapter
Microsoft Entra ID
Key term
Microsoft Sentinel
Microsoft Sentinel is a cloud-native security information and event management (SIEM) and security orchestration automation and response (SOAR) service that helps organizations detect, investigate, and respond to cyber threats across their entire digital estate.
Key term
SIEM
SIEM (Security Information and Event Management) is a system that collects and analyzes log data from across an IT environment to detect and respond to security threats in real time.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.