easyMultiple ChoiceObjective-mapped
SC-200 Practice Question: A security analyst in Microsoft 365 Defender is…
A security analyst in Microsoft 365 Defender is investigating an incident that involves multiple devices. The analyst wants to see a visual representation of the attack, showing how the attacker moved from one device to another. Which feature provides this view?
⚠ Common exam trap
Test-takers frequently confuse the Incident graph with Advanced hunting, thinking that a query-based tool is needed to visualize attack paths, but the Incident graph provides this visualization automatically without requiring any query writing.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Incident graph
The Incident graph in Microsoft 365 Defender provides a visual, interactive representation of an attack, showing how the attacker moved from one device to another, including lateral movement paths and related alerts. This feature is specifically designed to help analysts understand the full scope of an incident by mapping out the relationships between entities such as devices, users, and alerts.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Alert queue
Why it's wrong here
The Alert queue is a tabular list view that displays individual alerts with metadata such as severity, status, and assigned user, but it does not correlate those alerts into an attack narrative. Each row represents a single detection and does not show relationships between devices, users, or alerts over time. Therefore, while useful for triage, it cannot provide the visual attack progression the analyst needs.
- ✓
Incident graph
Why this is correct
The Incident graph is a dedicated visualization that maps the full attack story by showing nodes for entities such as devices, users, and alerts, and edges representing causal relationships and movement. It automatically aggregates related alerts from the merged incident and provides a timeline-based view of how the attacker entered and expanded across the environment. This allows the analyst to identify the attack path and affected scope at a glance.
- ✗
Advanced hunting
Why it's wrong here
Advanced hunting is a schema-based query tool in which an analyst writes Kusto Query Language (KQL) queries to search raw event data across tables like DeviceProcessEvents and EmailEvents. It returns a tabular result set rather than a pre-built visual graph, requiring the analyst to construct their own correlation logic. Although powerful for custom investigations, it is not the intuitive visual incident graph feature referenced in the scenario.
- ✗
Action center
Why it's wrong here
The Action center is the centralized hub for managing remediation actions that have been submitted or completed, such as isolating a device, quarantining a file, or collecting an investigation package. It displays the action status, related threat, and device, but it does not illustrate how the attacker moved through the network. Thus, it focuses on response execution rather than attack visualization.
Go deeper
Related to this question
About these practice questions
One of 209 original SC-200 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.