AZ-500 Manage identity and access Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Incident timeline

  Why it's wrong here

  The incident timeline in Microsoft Sentinel is a chronological, time-ordered list of the alerts, anomalies, and bookmarks attached to an incident. It is useful for establishing the order of events (e.g., which alert fired first), but it does not visualize the underlying entity graph—such as which user, IP address, or host communicated with another host. Because it renders a flat list rather than linked nodes, it cannot illustrate the attack path or the full scope of an incident.

• ✓

  Investigation graph

  Why this is correct

  The investigation graph in Microsoft Sentinel is purpose-built for interactive incident analysis: it displays the incident's extracted entities—such as accounts, IP addresses, hosts, and URLs—as nodes and connects them to the alerts that reference those entities, creating an attack-path visualization. From any node, an analyst can expand to see related alerts, user activities, and other entities, helping to identify the root cause and the scope of the threat. This is the correct tool because it directly supports the analyst's need to examine entity relationships, unlike a sequential timeline or a proactive query engine.

• ✗

  Hunting

  Why it's wrong here

  Microsoft Sentinel's hunting capability is a proactive threat-hunting tool that runs KQL queries over a defined time range to identify suspicious behavior before or independently of an incident. Although hunt results can be bookmarked and later added to an incident, hunting itself does not provide an incident-specific, entity-relationship graph and is not designed for analyzing an already-created incident. Using hunting here would trigger a broad, unguided search when the investigation should instead focus on the entities and alerts already associated with the incident.

• ✗

  Analytics rules

  Why it's wrong here

  Analytics rules in Microsoft Sentinel are configuration objects that define detection logic—for example, scheduled queries, anomaly thresholds, or correlation pipelines—that evaluate data ingestion and create alerts when a condition is met. These rules operate at the alert-creation stage; once an incident is generated, the rule is no longer part of the incident investigation interface and offers no interactive canvas for exploring entity associations. Therefore, an analyst investigating an existing incident would not use analytics rules to visualize entity connections.

Go deeper

Related to this question