SC-900 Practice Question: Describe the concepts of security, compliance, and identity
Your organization uses Microsoft Sentinel as a SIEM. You need to create a rule that triggers an incident when a user account is created in an Azure subscription and then logs in from an unfamiliar location within 24 hours. Which type of rule should you configure?
⚠ Common exam trap
A common mix-up: candidates confuse scheduled query rules with near-real-time (NRT) rules, mistakenly thinking NRT rules can handle long correlation windows, but NRT rules are limited to a 10-minute lookback and cannot span 24 hours.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Scheduled query rule
A scheduled query rule is the correct choice because it allows you to define a KQL query that detects user account creation events (e.g., from AzureActivity) and then correlates those with sign-in logs (e.g., from SigninLogs) from unfamiliar locations within a 24-hour window. This rule type supports complex multi-table joins and time-based correlation, which is exactly what the scenario requires.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Anomaly detection rule
Why it's wrong here
Anomaly detection rules in Microsoft Sentinel are primarily driven by machine learning algorithms that establish a baseline of normal behavior and then flag deviations from that baseline. These rules are designed to identify unusual activities or patterns that might indicate a threat, rather than executing custom, user-defined correlation logic across specific events over a fixed 24-hour period. They are not suitable for scenarios requiring explicit KQL queries to join and analyze events based on custom criteria.
- ✓
Scheduled query rule
Why this is correct
Scheduled query rules are the appropriate choice for correlating events over a specific time window, such as 24 hours. These rules allow security analysts to write custom Kusto Query Language (KQL) queries that can join multiple data sources, apply complex logic, and identify specific patterns or sequences of events. They can be configured to run at defined intervals (e.g., daily) and look back over a specified period, making them ideal for long-duration correlation and custom threat detection scenarios.
- ✗
Fusion rule
Why it's wrong here
Fusion rules in Microsoft Sentinel leverage advanced artificial intelligence and machine learning to automatically correlate multiple low-fidelity alerts across different products into high-fidelity, actionable incidents. While powerful for detecting multi-stage attacks, Fusion is a pre-built, proprietary correlation engine focused on alerts, not raw events. It does not allow for custom KQL logic to define specific event correlations over a user-defined 24-hour period.
- ✗
Near-real-time (NRT) rule
Why it's wrong here
Near-real-time (NRT) rules are designed for rapid threat detection, running KQL queries as frequently as every minute to identify immediate threats. While they offer speed, their primary purpose is for short-duration, high-frequency checks, not for correlating events that span an entire 24-hour period. An NRT rule's 1-minute interval and typical lookback window are optimized for immediate alerts, making it inefficient and unsuitable for comprehensive daily correlation tasks requiring a broader time scope.
Go deeper
Related to this question
Learn chapter
Microsoft Entra ID
Key term
SIEM
SIEM (Security Information and Event Management) is a system that collects and analyzes log data from across an IT environment to detect and respond to security threats in real time.
Key term
Subscription
A subscription is a payment model where you pay a recurring fee to access a product or service instead of buying it once and owning it forever.
About these practice questions
This SC-900 question is part of Courseiva's 1,250-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.