SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
A company uses Microsoft Sentinel to centralize security logs. They want to correlate AWS CloudTrail logs with Azure AD sign-in logs. Which Microsoft Sentinel feature should they use?
⚠ Common exam trap
Many exam-takers confuse 'correlation' with 'visualization' (Workbooks) or 'response' (Playbooks), but only Analytics Rules provide the automated, scheduled log correlation needed to detect multi-source threats.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Analytics rules
Analytics rules in Microsoft Sentinel are designed to correlate and analyze data from multiple sources, such as AWS CloudTrail and Azure AD sign-in logs, to detect security threats. By creating a multi-source analytics rule, you can define conditions that trigger alerts when suspicious patterns emerge across these disparate log streams, enabling centralized threat detection.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Workbooks
Why it's wrong here
Microsoft Sentinel Workbooks are interactive dashboards designed for data visualization, reporting, and monitoring of security data. They allow security analysts to create custom views and gain insights into trends and anomalies through charts and tables. However, Workbooks do not actively correlate events or generate alerts based on predefined threat detection logic; their primary function is observational and analytical, not automated threat detection.
- ✗
Playbooks
Why it's wrong here
Microsoft Sentinel Playbooks, built on Azure Logic Apps, are automation tools used to orchestrate and automate security responses to incidents or alerts. While they can be triggered by analytics rules or incidents, their role is to execute predefined actions such as blocking an IP, enriching an entity, or creating a ticket. Playbooks act *after* a threat has been detected, rather than defining the correlation logic for detecting the threat itself across various data sources.
- ✓
Analytics rules
Why this is correct
Microsoft Sentinel Analytics rules are the core mechanism for proactively detecting threats and generating incidents by correlating events across connected data sources. These rules leverage Kusto Query Language (KQL) to define specific patterns, behaviors, or anomalies that indicate malicious activity, executing on a scheduled basis to identify threats that might otherwise go unnoticed. They are specifically designed to perform the continuous event correlation required for automated threat detection and alerting.
- ✗
Hunting
Why it's wrong here
Microsoft Sentinel Hunting capabilities enable security analysts to proactively search for threats and anomalies within their ingested data that have not yet been detected by automated rules. This involves running ad-hoc KQL queries and exploring data interactively to uncover sophisticated or novel attack techniques. While crucial for advanced threat discovery and investigation, hunting is a manual, investigative process, not an automated system for continuous event correlation and alert generation.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
CloudTrail
AWS CloudTrail is a service that records every action taken in your AWS account, creating a detailed log of who did what and when for security and auditing purposes.
Key term
Microsoft Sentinel
Microsoft Sentinel is a cloud-native security information and event management (SIEM) and security orchestration automation and response (SOAR) service that helps organizations detect, investigate, and respond to cyber threats across their entire digital estate.
About these practice questions
This SC-900 question is part of Courseiva's 1,250-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.