SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
Your organization uses Microsoft Sentinel to detect threats. A security analyst needs to create a custom analytics rule that triggers an incident when a user accesses more than 1000 files from an external IP address within 5 minutes. Which rule type should the analyst configure?
⚠ Common exam trap
A common mix-up: candidates confuse near-real-time (NRT) rules with scheduled rules, assuming NRT can handle any time window, but NRT rules are limited to a 1-minute lookback and cannot aggregate over longer periods like 5 minutes.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Scheduled query rule
A scheduled query rule is the correct choice because it allows the analyst to define a custom KQL query that counts file access events from external IPs and triggers an incident when the threshold of 1000 files within 5 minutes is exceeded. This rule type supports aggregation, time windows, and custom thresholds, making it ideal for detecting specific behavioral patterns like high-volume access from external sources.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Fusion rule
Why it's wrong here
Fusion rules are an out-of-the-box capability in Microsoft Sentinel that leverage advanced machine learning to automatically correlate multiple low-fidelity alerts into high-fidelity incidents. They are designed to reduce alert fatigue by identifying complex attack chains without requiring custom KQL or user-defined aggregation logic, making them unsuitable for specific custom aggregation thresholds.
- ✗
ML Behavior Analytics rule
Why it's wrong here
ML Behavior Analytics rules are a core component of Microsoft Sentinel's User and Entity Behavior Analytics (UEBA) solution, focusing on detecting anomalous activities by users and entities. These rules utilize pre-built machine learning models to establish baselines and identify deviations, rather than allowing security analysts to define custom KQL queries with specific aggregation logic or time windows for general threat detection.
- ✓
Scheduled query rule
Why this is correct
Scheduled query rules are the foundational and most flexible type of analytics rule in Microsoft Sentinel for custom threat detection. They allow security analysts to define precise Kusto Query Language (KQL) queries that run at specified intervals, look back over a defined time range (e.g., 5 minutes), and perform complex aggregations and filtering to identify threats based on custom thresholds and logic.
- ✗
Near-real-time (NRT) query rule
Why it's wrong here
Near-real-time (NRT) query rules are optimized for detecting threats with minimal latency, executing KQL queries as frequently as every minute. While providing rapid detection, NRT rules are primarily designed to process data from the most recent minute, making them unsuitable for scenarios that require aggregating data over a longer, custom time window like five minutes to identify patterns or thresholds.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Organization
An Organization is a top-level container in Google Cloud that represents your company or entities and serves as the root node for all your cloud resources, policies, and access control.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.