SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
A cybersecurity analyst uses Microsoft Sentinel to detect threats. Which THREE types of analytics rules can be created?
⚠ Common exam trap
Candidates often confuse 'hunting' (an interactive process) with an analytics rule type, or assume 'machine learning rules' exist as a separate category when they are actually implemented via Fusion and Anomaly rules.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Scheduled query rules
Scheduled query rules are correct because they allow you to define a KQL query that runs on a set schedule (e.g., every 5 minutes) to detect threats by analyzing log data from multiple sources. This is a core analytics rule type in Microsoft Sentinel for proactive threat detection based on time-based patterns.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Scheduled query rules
Why this is correct
Scheduled query rules are the most widely used type of analytics rule in Microsoft Sentinel, executing a custom Kusto Query Language (KQL) query against ingested log data at predefined, recurring intervals. These rules are designed to detect specific patterns, anomalies, or thresholds in security events over time, automatically generating an incident when the query returns results, thus alerting security analysts to potential threats.
- ✓
Near-real-time (NRT) rules
Why this is correct
Near-real-time (NRT) rules are a specialized type of analytics rule in Microsoft Sentinel engineered for rapid detection of critical, time-sensitive threats. Unlike standard scheduled rules, NRT rules run their KQL queries at a significantly higher frequency, typically every minute, enabling almost immediate identification of high-priority security events and substantially reducing the mean time to detect (MTTD) for urgent attack scenarios.
- ✗
Hunting rules
Why it's wrong here
Hunting rules are not a distinct, automated rule type for threat detection within Microsoft Sentinel's analytics engine. Instead, "Hunting" refers to the proactive, manual exploration of security data by analysts using KQL queries to uncover novel or subtle threats that automated rules might miss. While a successful hunting query can be subsequently converted into a scheduled analytics rule, hunting itself is a human-driven investigative activity, not an automated detection mechanism.
- ✓
Fusion rules
Why this is correct
Fusion rules leverage Microsoft's proprietary machine learning and AI algorithms to automatically detect sophisticated, multi-stage attacks that involve multiple, seemingly disparate alerts across different products and stages of the kill chain. Instead of relying on a single KQL query, Fusion correlates low-fidelity signals from various sources into high-fidelity incidents, significantly reducing alert fatigue and identifying complex attack campaigns that would otherwise be missed by individual rules.
- ✗
Machine learning rules
Why it's wrong here
"Machine learning rules" are not a standalone, configurable rule type that users directly create or manage within Microsoft Sentinel's analytics blade. While machine learning capabilities are an integral underlying technology for advanced detection mechanisms like Fusion rules, and some built-in analytics rules might utilize ML models internally, users do not define or deploy a category of rules explicitly labeled as "machine learning rules" alongside scheduled or NRT rules.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Microsoft Sentinel
Microsoft Sentinel is a cloud-native security information and event management (SIEM) and security orchestration automation and response (SOAR) service that helps organizations detect, investigate, and respond to cyber threats across their entire digital estate.
Key term
Threat
A threat is any potential danger that could harm a computer system, network, or data, whether from a malicious hacker, a natural disaster, or an accidental mistake.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.