Describe the capabilities of Microsoft security solutions →hardMultiple ChoiceObjective-mapped

SC-900 Practice Question: Describe the capabilities of Microsoft security solutions

Exhibit

{
  "exhibit": "Refer to the exhibit. The following is a KQL query run in Microsoft Sentinel: \nSecurityEvent | where TimeGenerated > ago(7d) | where EventID == 4625 | summarize FailedLogins = count() by Account, Computer | where FailedLogins > 10 | project Account, Computer, FailedLogins | sort by FailedLogins desc"
}

Refer to the exhibit. A security analyst runs this KQL query in Microsoft Sentinel. What is the most likely purpose of this query?

⚠ Common exam trap

Many candidates confuse the aggregation of failed logons (Event ID 4625) with account lockout events (Event ID 4740), but the query lacks any reference to lockout status or successful logins, making brute-force detection the only logical purpose.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

To identify potential brute-force attack attempts

The query filters for Windows Event ID 4625 (failed logon) and then counts occurrences per account and source IP within a 5-minute window, keeping only those with more than 10 failures. This pattern is the classic signature of a brute-force attack, where an attacker attempts many passwords against the same account or from the same IP. Option D is correct because the query is specifically designed to identify potential brute-force attempts by aggregating failed logons.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
To identify successful logins after multiple failures
Why it's wrong here
The KQL query specifically targets EventID 4625, which exclusively represents failed login attempts in Windows Security Event Logs. It does not include EventID 4624 for successful logins, nor does it correlate failed attempts with subsequent successful ones. Therefore, this query cannot identify successful logins, regardless of any prior failures.
✗
To detect privilege escalation events
Why it's wrong here
Privilege escalation events are typically indicated by distinct Event IDs, such as 4672 (Special privileges assigned to new logon) or other events related to process creation with elevated privileges or changes to security groups. This KQL query, focused solely on EventID 4625 (failed logins), does not monitor the specific event types or attributes associated with privilege escalation attempts or successes.
✗
To detect accounts that have been locked out
Why it's wrong here
While failed login attempts can lead to account lockouts, the KQL query itself does not directly detect the lockout event. Account lockouts are specifically logged with EventID 4740 (A user account was locked out) in Windows Security Event Logs. The current query, by filtering only for EventID 4625, identifies failed login attempts but not the subsequent lockout status.
✓
To identify potential brute-force attack attempts
Why this is correct
A KQL query that aggregates and counts EventID 4625 (failed login attempts) for individual user accounts within a specific timeframe is highly effective for detecting potential brute-force attacks. A significantly elevated number of failed login attempts against a single account or a small set of accounts strongly indicates an attacker systematically trying multiple password combinations. This pattern is a hallmark of brute-force activity.

Go deeper

SC-900 Practice Question: Describe the capabilities of Microsoft security solutions

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question