SC-900 Practice Question: Describe the concepts of security, compliance, and identity
Exhibit
{
"query": "SigninLogs | where TimeGenerated > ago(1d) | where ResultType == 50057 | project UserPrincipalName, IPAddress, TimeGenerated"
}Refer to the exhibit. A security analyst runs this Kusto Query Language (KQL) query in Microsoft Sentinel. What is being identified?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Sign-in attempts by disabled user accounts.
The query filters sign-in logs from the last day with ResultType 50057, which indicates that the user account is disabled. Therefore, the query is identifying sign-in attempts by disabled user accounts. Option A is incorrect because MFA failures have different result types (e.g., 500121, 50074). Option B is incorrect because successful sign-ins have ResultType 0. Option C is incorrect because unknown IP addresses are not identified by ResultType 50057; they would involve other fields or result types.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Multi-factor authentication failures.
Why it's wrong here
Multi-factor authentication failures are associated with result types like 50053, not 50057.
- ✗
Successful sign-ins in the last day.
Why it's wrong here
Successful sign-ins have ResultType 0, not 50057.
- ✗
Sign-in attempts from unknown IP addresses.
Why it's wrong here
Sign-in attempts from unknown IP addresses are not indicated by ResultType 50057; the query filters based on the result type, not IP address.
- ✓
Sign-in attempts by disabled user accounts.
Why this is correct
ResultType 50057 corresponds to 'User account is disabled', so this query identifies sign-in attempts by disabled accounts.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
MFA
Multi-Factor Authentication (MFA) is a security method that requires a user to verify their identity using two or more different types of evidence, such as a password plus a code from a phone, before they can access an account or system.
Key term
Microsoft Sentinel
Microsoft Sentinel is a cloud-native security information and event management (SIEM) and security orchestration automation and response (SOAR) service that helps organizations detect, investigate, and respond to cyber threats across their entire digital estate.
About these practice questions
This SC-900 question is part of Courseiva's 1,250-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.