Describe the capabilities of Microsoft security solutions →hardMultiple ChoiceObjective-mapped

SC-900 Practice Question: Describe the capabilities of Microsoft security solutions

Exhibit

Refer to the exhibit.

```json
{
  "alertRule": {
    "displayName": "Unusual sign-in from unfamiliar location",
    "query": "SigninLogs | where RiskLevelDuringSignIn == 'medium' or RiskLevelDuringSignIn == 'high' | where Location != 'US'",
    "frequency": "PT1H",
    "severity": 2
  }
}
```

Refer to the exhibit. You are creating a custom analytics rule in Microsoft Sentinel. What does this rule detect?

⚠ Common exam trap

Test-takers frequently confuse 'User risk' with 'Sign-in risk' — the rule explicitly uses sign-in risk, and candidates often misread the risk type or overlook the location filter, leading them to choose options that mix up these conditions.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Sign-ins with medium or high risk from outside the US

The rule is configured with 'Risk level: Medium, High' and 'Location: Outside US'. This means it triggers only when both conditions are met: the sign-in risk is medium or high, and the location is outside the US. Option D correctly matches this combination, detecting sign-ins with medium or high risk from outside the US.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Sign-ins with high sign-in risk from any location
Why it's wrong here
The rule's logic includes both medium and high sign-in risk levels, not exclusively high risk. Furthermore, the condition explicitly filters for sign-ins originating from *outside* the US, meaning that 'any location' is incorrect as it would encompass US locations which are specifically excluded by the actual rule's criteria.
✗
Sign-ins with medium or high risk from the US
Why it's wrong here
While the specified risk level condition of medium or high sign-in risk aligns with the query's intent, the location condition is fundamentally incorrect. The rule explicitly excludes sign-ins originating from the United States, focusing instead on activities from international locations to detect potential threats and anomalous access patterns.
✗
Sign-ins from users with high user risk outside the US
Why it's wrong here
This option incorrectly references 'user risk' instead of 'sign-in risk.' Azure AD Identity Protection clearly distinguishes between these two types of risk; the rule specifically evaluates the risk associated with the sign-in attempt itself, rather than the cumulative, historical risk profile of the user account.
✓
Sign-ins with medium or high risk from outside the US
Why this is correct
This option accurately describes the criteria for the custom analytics rule. The rule targets sign-in attempts that Azure AD Identity Protection has classified with either a medium or high sign-in risk level. Additionally, it specifically filters these risky sign-ins to only include those originating from locations outside the United States, indicating a focus on external or geographically unusual threats.

Go deeper

SC-900 Practice Question: Describe the capabilities of Microsoft security solutions

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question