SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
A SOC analyst in Microsoft Sentinel needs to create a custom detection rule that triggers an incident when more than 10 failed logins occur from a single IP address within 5 minutes. Which rule type should they use?
⚠ Common exam trap
Watch out — candidates often confuse near-real-time (NRT) rules with scheduled queries, but NRT rules cannot perform time-based aggregations over a 5-minute window and are limited to single-event detection with a 1-minute lookback.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Scheduled query analytics rule
A scheduled query analytics rule is the correct choice because it allows the SOC analyst to define a custom KQL query that counts failed logins per IP address over a 5-minute window and triggers an incident when the count exceeds 10. This rule type runs on a recurring schedule (e.g., every 5 minutes) and is designed for threshold-based detection scenarios like brute-force attacks.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Anomaly analytics rule
Why it's wrong here
Anomaly analytics rules leverage machine learning models to identify deviations from established baselines, rather than relying on explicit, static thresholds defined by a security analyst. These rules are designed for unsupervised detection of unusual behavior and do not support the creation of custom KQL queries with specific, user-defined conditions for incident generation.
- ✗
Near-real-time (NRT) analytics rule
Why it's wrong here
Near-real-time (NRT) analytics rules are optimized for rapid, high-volume event processing over very short lookback periods, typically one minute. However, they have significant limitations regarding complex KQL aggregations, joins, and advanced analytical functions, making them unsuitable for scenarios requiring sophisticated correlation or custom thresholding across broader datasets.
- ✗
Microsoft security analytics rule
Why it's wrong here
Microsoft security analytics rules are primarily designed to ingest and normalize alerts generated by various Microsoft security products, such as Microsoft Defender XDR or Microsoft Defender for Cloud. These rules act as connectors and templates to bring existing security alerts into Sentinel, not as a mechanism for creating new, custom detection logic based on raw log data using KQL.
- ✓
Scheduled query analytics rule
Why this is correct
Scheduled query analytics rules are the foundational method in Microsoft Sentinel for creating highly customizable detection logic using Kusto Query Language (KQL). They allow security analysts to define complex queries, perform aggregations, apply advanced filtering, and set precise threshold conditions over specified time ranges to identify specific threats and generate incidents based on unique organizational requirements.
Go deeper
Related to this question
Learn chapter
Microsoft Entra ID
Key term
Incident
An incident is a security event that violates an organization's policies or threatens its data, systems, or operations, requiring a structured response.
Key term
Microsoft Sentinel
Microsoft Sentinel is a cloud-native security information and event management (SIEM) and security orchestration automation and response (SOAR) service that helps organizations detect, investigate, and respond to cyber threats across their entire digital estate.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.