Describe the concepts of security, compliance, and identity →hardMultiple Choice

SC-900 Practice Question: Describe the concepts of security, compliance, and identity

Exhibit

Refer to the exhibit.

```kusto
SigninLogs
| where TimeGenerated > ago(1d)
| where UserPrincipalName == "user@contoso.com"
| summarize signinCount = count() by IPAddress
| where signinCount > 10
```

You run the following KQL query in Microsoft Sentinel. What is the purpose of this query?

```kusto SigninLogs | where UserPrincipalName == "admin@contoso.com" | where ResultType == "50126" | summarize FailedAttempts = count() by IPAddress | sort by FailedAttempts desc ```

⚠ Common exam trap

SC-900 often tests the ability to distinguish between different sign-in failure codes and aggregation patterns, so candidates may mistakenly assume any failed sign-in query is about MFA or multi-user analysis, when the specific ResultType 50126 and single-user filter clearly indicate a brute-force detection.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

To detect potential brute-force attacks against a specific user account

The query filters SigninLogs for a specific user (admin@contoso.com) and a specific failure code (ResultType == "50126"), then counts failed attempts per IP address and sorts descending. ResultType 50126 corresponds to 'Invalid username or password' in Microsoft Entra ID sign-in logs. Aggregating by IPAddress and sorting by FailedAttempts desc reveals which IPs are generating the most failed logins for that account, which is the classic pattern of a brute-force or password spray attack targeting a single user.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
To detect potential brute-force attacks against a specific user account
Why this is correct
Filtering SigninLogs to one UserPrincipalName and error 50126 (invalid credentials), then counting failures per IPAddress and sorting descending, surfaces source addresses generating repeated failed sign-ins. That pattern indicates a brute-force or password-spray attempt targeting that specific account.
✗
To find all users who signed in from multiple IP addresses
Why it's wrong here
The query pins UserPrincipalName to a single account, so it cannot find users signing in from multiple IPs. It is tempting because summarising by IPAddress resembles impossible-travel detection, but that requires grouping by user across many accounts, not filtering to one.
✗
To identify sign-ins that failed multi-factor authentication
Why it's wrong here
ResultType 50126 signals invalid username or password, so the query counts failed password authentications per IP, not MFA failures. It is tempting because both are sign-in failures, but MFA-specific failures carry different ResultType codes such as 50074 or 500121.
✗
To list all IP addresses that accessed the tenant
Why it's wrong here
The query filters to one account and one failure code, so it returns only IPs with failed password attempts for that user, not every IP that accessed the tenant. It is tempting because SigninLogs does record source IPs, but no filter here captures successful or unrelated access.

Go deeper

SC-900 Practice Question: Describe the concepts of security, compliance, and identity

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question