Describe the capabilities of Microsoft security solutions →hardMultiple ChoiceObjective-mapped

SC-900 Practice Question: Describe the capabilities of Microsoft security solutions

Exhibit

Refer to the exhibit.

let timeRange = 7d;
SigninLogs
| where TimeGenerated > ago(timeRange)
| where ResultType == "50057"
| project TimeGenerated, UserPrincipalName, IPAddress, Location
| summarize Attempts = count() by UserPrincipalName
| where Attempts > 10
| order by Attempts desc

You are analyzing sign-in logs in Microsoft Sentinel. Based on the KQL query in the exhibit, what is the purpose of this query?

⚠ Common exam trap

It's easy for candidates to confuse the 'ResultType' value '50057' with a generic failed sign-in code (e.g., '50053' for locked accounts or '50126' for invalid credentials), leading them to incorrectly select option D (locations with highest failed sign-ins) instead of recognizing the specific disabled-account scenario.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Identify users who have attempted to sign in with a disabled account more than 10 times in the last 7 days.

The KQL query filters sign-in logs for events where the 'ResultType' is '50057', which specifically indicates a sign-in attempt from a disabled account. It then groups by user and counts occurrences, using a 'where' clause to filter for users with more than 10 such attempts. Finally, it limits the results to the last 7 days via the time range filter in the query or the workspace time filter. This directly identifies users who have attempted to sign in with a disabled account more than 10 times in the last 7 days.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Identify users who have attempted to sign in with a disabled account more than 10 times in the last 7 days.
Why this is correct
This query correctly identifies users targeting disabled accounts by specifically filtering for `ResultType 50057`, which signifies an account is disabled. By then grouping these events by `UserPrincipalName`, counting the occurrences, and applying a `where count_ > 10` clause within a specified 7-day timeframe, it precisely pinpoints users exceeding the defined threshold of failed attempts against disabled accounts. This is a critical indicator of potential malicious activity or persistent user error.
✗
Identify all sign-in attempts from a specific IP address.
Why it's wrong here
This option is incorrect because the described query groups sign-in attempts by `UserPrincipalName`, focusing on individual user activity rather than the originating network address. To identify all sign-in attempts from a specific IP address, the query would need to filter directly on the `IPAddress` field or group events by `IPAddress` to aggregate data from particular sources. Grouping by user principal name means the IP address is a detail within a user's activity, not the primary aggregation key.
✗
Identify impossible travel activity across different locations.
Why it's wrong here
This query is not designed to identify impossible travel activity. Impossible travel detection requires analyzing a sequence of sign-in events for a single user, comparing the geographic locations of consecutive sign-ins, and calculating the travel speed between them to detect physically impossible transitions. The query described focuses on a specific `ResultType` and a count of attempts per user, without the necessary temporal or geographical comparison logic required for impossible travel analysis.
✗
Identify locations with the highest number of failed sign-ins.
Why it's wrong here
This option is incorrect because the query groups sign-in events by `UserPrincipalName`, meaning it aggregates data per user, not per geographical location. To identify locations with the highest number of failed sign-ins, the query would need to group events by a location-based field such as `Location` or `City`, then filter for failed attempts (e.g., `ResultType` not equal to 0) and count them per location. The current grouping mechanism prevents this location-centric analysis.

Go deeper

SC-900 Practice Question: Describe the capabilities of Microsoft security solutions

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question