The answer is the Incident graph. This feature is the correct choice because it provides a visual, interactive representation of an attack, mapping exactly how an attacker moved from one device to another, including lateral movement paths and the relationships between entities like devices, users, and alerts. On the Microsoft Security Operations Analyst SC-200 exam, this question tests your ability to identify the specific tool within Microsoft 365 Defender that delivers incident graph attack visualization for understanding the full scope of a multi-device compromise. A common trap is confusing the Incident graph with the unified alert queue or the device timeline, but remember: the graph is the only view that explicitly shows lateral movement and entity connections. A useful memory tip is to think of the Incident graph as a “crime scene map” that connects all the dots, while other features only show individual pieces of evidence.
SC-200 Mitigate threats using Microsoft Defender XDR Practice Question
This SC-200 practice question tests your understanding of mitigate threats using microsoft defender xdr. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. A key principle to apply: the Incident graph visually maps the entire attack story.. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A security analyst in Microsoft 365 Defender is investigating an incident that involves multiple devices. The analyst wants to see a visual representation of the attack, showing how the attacker moved from one device to another. Which feature provides this view?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Incident graph
The Incident graph in Microsoft 365 Defender provides a visual, interactive representation of an attack, showing how the attacker moved from one device to another, including lateral movement paths and related alerts. This feature is specifically designed to help analysts understand the full scope of an incident by mapping out the relationships between entities such as devices, users, and alerts.
Key principle: The Incident graph visually maps the entire attack story.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Alert queue
Why it's wrong here
The Alert queue is a list view of alerts; it does not provide a visual representation of attack progression.
✓
Incident graph
Why this is correct
The Incident graph maps the entire attack story, showing how the attacker moved across devices and other entities.
Related concept
The Incident graph visually maps the entire attack story.
✗
Advanced hunting
Why it's wrong here
Advanced hunting is a query-based tool for searching raw data; it does not offer a pre-built visual graph of an incident.
✗
Action center
Why it's wrong here
The Action center lists pending and completed remediation actions; it does not show the attack path.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates often confuse the Incident graph with Advanced hunting, thinking that a query-based tool is needed to visualize attack paths, but the Incident graph provides this visualization automatically without requiring any query writing.
Trap categories for this question
Command / output trap
The Action center lists pending and completed remediation actions; it does not show the attack path.
Detailed technical explanation
How to think about this question
The Incident graph leverages the Microsoft 365 Defender correlation engine, which automatically links related alerts and entities based on common attributes like device IDs, user accounts, and IP addresses. Under the hood, it uses a graph database to represent entities as nodes and relationships as edges, enabling analysts to interactively explore attack paths, such as a device being compromised and then used to access another device via RDP or SMB. In a real-world scenario, this helps identify if an attacker used a compromised workstation to pivot to a domain controller, even if the alerts are generated by different Defender products (e.g., Defender for Endpoint and Defender for Identity).
KKey Concepts to Remember
The Incident graph visually maps the entire attack story.
It shows lateral movement across devices and other entities.
The graph aggregates related alerts and evidence.
It provides an interactive timeline of the incident.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
The Incident graph visually maps the entire attack story.
Real-world example
How this comes up in practice
A cloud solutions architect for a retail company is evaluating services for a new workload. The correct answer here reflects best practice for the specific scenario described — not a general cloud recommendation. The Incident graph visually maps the entire attack story. Cloud exam questions reward reading the constraint carefully: the same technology can be right or wrong depending on the use case.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this SC-200 question in full detail.
Mitigate threats using Microsoft Defender XDR — This question tests Mitigate threats using Microsoft Defender XDR — The Incident graph visually maps the entire attack story..
What is the correct answer to this question?
The correct answer is: Incident graph — The Incident graph in Microsoft 365 Defender provides a visual, interactive representation of an attack, showing how the attacker moved from one device to another, including lateral movement paths and related alerts. This feature is specifically designed to help analysts understand the full scope of an incident by mapping out the relationships between entities such as devices, users, and alerts.
What should I do if I get this SC-200 question wrong?
Review the Incident graph visually maps the entire attack story., then practise related SC-200 questions on the same topic to reinforce the concept.
What is the key concept behind this question?
The Incident graph visually maps the entire attack story.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.