Describe the capabilities of Microsoft security solutions →hardMultiple Choice

Microsoft Sentinel Analytics Rule Types Explained

Exhibit

Refer to the exhibit.

```json
{
  "alertRule": {
    "displayName": "Unusual sign-in from unfamiliar location",
    "query": "SigninLogs | where RiskLevelDuringSignIn == 'medium' or RiskLevelDuringSignIn == 'high' | where Location != 'US'",
    "frequency": "PT1H",
    "severity": 2
  }
}
```

Refer to the exhibit. You are creating a custom analytics rule in Microsoft Sentinel. What does this rule detect?

⚠ Common exam trap

Test-takers frequently confuse 'User risk' with 'Sign-in risk' — the rule explicitly uses sign-in risk, and candidates often misread the risk type or overlook the location filter, leading them to choose options that mix up these conditions.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Sign-ins with medium or high risk from outside the US

The rule is configured with 'Risk level: Medium, High' and 'Location: Outside US'. This means it triggers only when both conditions are met: the sign-in risk is medium or high, and the location is outside the US. Option D correctly matches this combination, detecting sign-ins with medium or high risk from outside the US.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Sign-ins with high sign-in risk from any location
Why it's wrong here
The rule's logic includes both medium and high sign-in risk levels, not exclusively high risk. Furthermore, the condition explicitly filters for sign-ins originating from *outside* the US, meaning that 'any location' is incorrect as it would encompass US locations which are specifically excluded by the actual rule's criteria.
✗
Sign-ins with medium or high risk from the US
Why it's wrong here
While the specified risk level condition of medium or high sign-in risk aligns with the query's intent, the location condition is fundamentally incorrect. The rule explicitly excludes sign-ins originating from the United States, focusing instead on activities from international locations to detect potential threats and anomalous access patterns.
✗
Sign-ins from users with high user risk outside the US
Why it's wrong here
This option incorrectly references 'user risk' instead of 'sign-in risk.' Microsoft Entra ID Protection clearly distinguishes between these two types of risk; the rule specifically evaluates the risk associated with the sign-in attempt itself, rather than the cumulative, historical risk profile of the user account.
✓
Sign-ins with medium or high risk from outside the US
Why this is correct
This option accurately describes the criteria for the custom analytics rule. The rule targets sign-in attempts that Microsoft Entra ID Protection has classified with either a medium or high sign-in risk level. Additionally, it specifically filters these risky sign-ins to only include those originating from locations outside the United States, indicating a focus on external or geographically unusual threats.

Go deeper

2 more ways this is tested on SC-900

These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.

Variation 1. You are analyzing sign-in logs in Microsoft Sentinel. Based on the KQL query in the exhibit, what is the purpose of this query?

hard

✓ A.Identify users who have attempted to sign in with a disabled account more than 10 times in the last 7 days.
B.Identify all sign-in attempts from a specific IP address.
C.Identify impossible travel activity across different locations.
D.Identify locations with the highest number of failed sign-ins.

Why A: The KQL query filters sign-in logs for events where the 'ResultType' is '50057', which specifically indicates a sign-in attempt from a disabled account. It then groups by user and counts occurrences, using a 'where' clause to filter for users with more than 10 such attempts. Finally, it limits the results to the last 7 days via the time range filter in the query or the workspace time filter. This directly identifies users who have attempted to sign in with a disabled account more than 10 times in the last 7 days.

Variation 2. Refer to the exhibit. The KQL query is used in a Microsoft Sentinel analytics rule. What is the primary purpose of this rule?

hard

A.To identify all files shared externally regardless of sensitivity
B.To automatically block external sharing of sensitive files
✓ C.To detect when a file labeled 'Highly Confidential' is shared externally
D.To list all alerts generated by the rule

Why C: The KQL query filters for activities where a file labeled 'Highly Confidential' is shared externally, using the `SensitivityLabel` property and the `SharingType` field set to 'ExternalUser'. The rule's primary purpose is to detect such sharing events, not to block them or list all alerts. Option C correctly identifies this detection goal.

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.

Microsoft Sentinel Analytics Rule Types Explained

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question

2 more ways this is tested on SC-900