Describe the capabilities of Microsoft security solutions →mediumMultiple ChoiceObjective-mapped

SC-900 Practice Question: Describe the capabilities of Microsoft security solutions

Your company uses Microsoft Sentinel to centralize security event monitoring. You need to create a custom analytics rule that triggers an alert when a user account is created outside of business hours. Which rule type should you use?

⚠ Common exam trap

Many candidates confuse near-real-time (NRT) rules with scheduled rules, but NRT rules cannot run custom KQL queries with time-based conditions like 'outside business hours' because they are optimized for low-latency, simple pattern matching rather than scheduled, complex logic.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Scheduled query analytics rule

A scheduled query analytics rule is the correct choice because it allows you to define a KQL query that runs on a set schedule (e.g., every 5 minutes) and triggers an alert based on conditions such as user account creation events occurring outside of business hours. This rule type is designed for custom detection scenarios where you need to evaluate log data against specific time-based or threshold-based criteria, making it ideal for monitoring user creation events with a custom schedule.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Microsoft Security incident creation rule
Why it's wrong here
Microsoft Security incident creation rules are specifically designed to automatically generate incidents within Microsoft Sentinel from existing alerts originating from integrated Microsoft security services, such as Microsoft Defender for Cloud or Microsoft 365 Defender. These rules do not process raw log data directly to identify new threats or create initial alerts; instead, their function is to orchestrate and consolidate pre-generated alerts into actionable incidents for security analysts.
✗
Anomaly analytics rule
Why it's wrong here
Anomaly analytics rules leverage sophisticated, built-in machine learning algorithms and behavioral analytics to automatically identify deviations from established baselines in your log data. They are pre-configured or adaptively learn normal patterns to detect unusual activities without requiring explicit KQL queries or custom conditions for specific event types, focusing on statistical outliers rather than predefined signatures.
✗
Near-real-time (NRT) analytics rule
Why it's wrong here
Near-real-time (NRT) analytics rules are optimized for extremely rapid execution, checking for threats and generating alerts every minute, making them ideal for high-priority, low-latency detections. However, to ensure this quick performance, their query capabilities are intentionally constrained to a single table and a limited set of KQL operators, preventing complex joins or aggregations across multiple data sources.
✓
Scheduled query analytics rule
Why this is correct
Scheduled query analytics rules are the most versatile and powerful type for implementing custom threat detection logic within Microsoft Sentinel. They enable security analysts to write complex KQL (Kusto Query Language) queries that run at defined intervals against various log tables, allowing for sophisticated correlation, aggregation, and pattern matching to identify specific security events, conditions, or indicators of compromise.

Go deeper

SC-900 Practice Question: Describe the capabilities of Microsoft security solutions

Why each option matters

Option-by-option breakdown

Related to this question