SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
Your organization uses Microsoft Sentinel. You need to create a custom analytics rule that triggers an incident when a user fails to sign in more than five times within an hour. Which rule type should you use?
⚠ Common exam trap
Test-takers frequently confuse 'near-real-time' with 'real-time aggregation over a window,' but NRT rules cannot perform time-based aggregation like counting events over an hour, which is a key differentiator from scheduled query rules.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Scheduled query rule
A scheduled query rule is the correct choice because it allows you to define a KQL query that counts sign-in failures per user over a specified time window (e.g., 1 hour) and triggers an incident when the count exceeds a threshold (e.g., 5). This rule type runs on a schedule you define, making it ideal for detecting patterns like brute-force attempts that require aggregation over time.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Scheduled query rule
Why this is correct
This rule type is fundamental for proactive threat detection in Microsoft Sentinel, enabling security analysts to define and execute custom KQL queries against ingested log data on a recurring schedule. It allows for specifying a precise query interval and a lookback period, triggering an alert only when the query results meet a predefined numerical threshold. This makes it ideal for identifying specific patterns, event counts, or conditions over a chosen time window.
- ✗
Fusion rule
Why it's wrong here
Fusion rules in Microsoft Sentinel are an advanced capability designed to automatically detect sophisticated multi-stage attacks by correlating disparate alerts from various security products. They leverage Microsoft's proprietary machine learning algorithms to identify complex threat chains that might otherwise go unnoticed. Crucially, these rules do not allow users to define custom KQL queries for direct log analysis or to set specific numerical thresholds for individual events.
- ✗
Near-real-time (NRT) analytics rule
Why it's wrong here
Near-real-time (NRT) analytics rules are specifically engineered for high-velocity threat detection, allowing KQL queries to run as frequently as every minute for immediate response. While providing rapid incident identification, their design imposes a strict limitation on the query's lookback period, typically a maximum of 5 minutes. This constraint prevents NRT rules from performing aggregations or analyses over longer durations, such as an hour or more, making them unsuitable for scenarios requiring broader historical context.
- ✗
Machine learning (ML) behavioral analytics rule
Why it's wrong here
Machine learning (ML) behavioral analytics rules in Microsoft Sentinel are dedicated to identifying anomalous user and entity behavior (UEBA) by establishing baselines of normal activity. These pre-built rules leverage sophisticated algorithms to detect deviations from these baselines, signaling potential compromises or insider threats. They are not designed for custom KQL query execution or for triggering alerts based on fixed, user-defined numerical thresholds for specific event occurrences.
Go deeper
Related to this question
Learn chapter
Microsoft Entra ID
Key term
Microsoft Sentinel
Microsoft Sentinel is a cloud-native security information and event management (SIEM) and security orchestration automation and response (SOAR) service that helps organizations detect, investigate, and respond to cyber threats across their entire digital estate.
Key term
Organization
An Organization is a top-level container in Google Cloud that represents your company or entities and serves as the root node for all your cloud resources, policies, and access control.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.