Describe the capabilities of Microsoft security solutions →hardMultiple ChoiceObjective-mapped

SC-900 Practice Question: Describe the capabilities of Microsoft security solutions

Exhibit

Microsoft Defender XDR - Advanced Hunting query:
let TimeFrame = 7d;
IdentityLogonEvents
| where Timestamp > ago(TimeFrame)
| where Application == "Office365"
| where LogonType == "Interactive"
| summarize LogonCount = count() by AccountUpn, IPAddress
| where LogonCount > 10

Refer to the exhibit. You run an Advanced Hunting query in Microsoft Defender XDR. What is the primary purpose of this query?

⚠ Common exam trap

Many exam-takers confuse 'interactive logons' with 'failed logon attempts' (Option A) or assume the query targets Office 365 applications specifically (Option B), when in fact the query counts all interactive logons regardless of success or application, and the high count is the key indicator of brute-force activity.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Identify accounts with high number of interactive logons, potentially indicating brute-force activity.

The query uses `AADSignInEventsBeta` to count interactive logon events per account, then filters for accounts with more than 10 such events. A high count of interactive logons from a single account is a classic indicator of brute-force activity, where an attacker repeatedly attempts to guess credentials. This makes D correct because the query's primary purpose is to identify accounts with a suspiciously high number of interactive logons.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Find IP addresses with failed logon attempts.
Why it's wrong here
This option is incorrect because the advanced hunting query does not include any filters to specifically identify failed logon attempts. Queries designed to detect failures typically filter on fields like 'ResultType' or 'Status' to isolate unsuccessful authentication events. Instead, the query focuses on counting successful interactive logons, making it unsuitable for finding IP addresses associated with authentication failures.
✗
List all interactive logons from Office 365 applications.
Why it's wrong here
This option is incorrect because the query applies an aggregation and a threshold filter, specifically counting logons per user and IP address and then only returning results where the count exceeds 10. Therefore, it does not list *all* interactive logons from any source, including Office 365 applications, but rather highlights specific instances of high-volume activity. It's designed for anomaly detection, not comprehensive logging.
✗
Detect non-interactive logons to Office 365.
Why it's wrong here
This option is incorrect because the query explicitly filters for `LogonType == 'Interactive'`. This condition specifically includes user-driven sign-ins and excludes non-interactive logons, which typically involve service principals, application identities, or automated processes. Therefore, the query is designed to analyze direct user activity, not programmatic or background authentication events.
✓
Identify accounts with high number of interactive logons, potentially indicating brute-force activity.
Why this is correct
This option is correct because the query groups logon events by 'UserPrincipalName' and 'IPAddress', then counts the occurrences. By filtering for a high count (e.g., `count_ > 10`), it effectively identifies accounts or source IP addresses exhibiting an unusually large number of interactive sign-ins within the queried timeframe. This pattern is a strong indicator of potential brute-force attacks or credential stuffing attempts, where an attacker repeatedly tries to gain access to an account.

Go deeper

SC-900 Practice Question: Describe the capabilities of Microsoft security solutions

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question