Describe the capabilities of Microsoft compliance solutions →hardMultiple ChoiceObjective-mapped

SC-900 Practice Question: Describe the capabilities of Microsoft compliance solutions

Exhibit

Refer to the exhibit.

```kusto
// KQL query in Microsoft Sentinel
SecurityAlert
| where AlertName == "MFA failure anomaly"
| where TimeGenerated > ago(7d)
| summarize Count = count() by UserPrincipalName
| where Count > 5
```

A security analyst runs the above KQL query in Microsoft Sentinel. What is the primary purpose of this query?

⚠ Common exam trap

The trap here is that candidates see 'MFA failure anomalies' and 'last 7 days' and assume the query returns all users with any anomaly (option B), missing the critical `where count_ > 5` threshold filter that narrows the result to only high-frequency failures.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Identify users with more than 5 MFA failure anomalies in the last 7 days

The KQL query uses `summarize` with `count()` on MFA failure anomalies, then filters with `where count_ > 5` and `where TimeGenerated > ago(7d)`. This explicitly returns only users whose anomaly count exceeds 5 in the last 7 days, making option D correct. The query does not correlate with other events, list all users with any anomaly, or check block status.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Correlate MFA failures with other security events
Why it's wrong here
The KQL query exclusively targets the `SecurityAlert` table and filters for specific MFA-related anomalies. It performs aggregation and filtering *within* this single table based on alert counts for individual entities. There are no `join` operations, `union` operations, or lookups to other tables (e.g., `SigninLogs`, `AuditLogs`, `DeviceEvents`) that would be necessary to correlate these MFA failures with other distinct security events or activities across different data sources.
✗
Identify all users who had an MFA failure anomaly in the last 7 days
Why it's wrong here
While the query indeed looks at MFA failure anomalies within the last 7 days, the crucial `where AlertCount > 5` clause (or similar, depending on the exact KQL) explicitly filters out users who had 5 or fewer such anomalies. Therefore, it does not return *all* users experiencing MFA failure anomalies, but rather a specific subset of users exhibiting a high frequency of these particular alerts.
✗
Identify users who have been blocked due to MFA failures
Why it's wrong here
The KQL query operates solely on the `SecurityAlert` table, aggregating and filtering alerts based on their count. It does not access or evaluate any fields or tables (e.g., `SigninLogs` with `ResultType` or `ResultDescription` indicating a block, or `AADRiskyUsers` for user status) that would provide information about whether a user account has been actively blocked or disabled as a consequence of MFA failures. The query's output is limited to user entities associated with a certain number of alerts.
✓
Identify users with more than 5 MFA failure anomalies in the last 7 days
Why this is correct
The query correctly filters `SecurityAlert` records generated within the last 7 days for MFA failure anomalies. It then groups these anomalies by user and calculates the total count for each user. The subsequent `where AlertCount > 5` clause precisely isolates and presents only those users whose aggregated count of MFA failure anomalies exceeds five, directly matching the objective described in this option.

Go deeper

SC-900 Practice Question: Describe the capabilities of Microsoft compliance solutions

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question