The answer is the incident graph, which is the correct feature in the Microsoft 365 Defender portal for viewing a visual attack progression. This tool provides an interactive, node-based map that traces the entire attack chain, from the initial entry point through lateral movement to all affected devices and users, correlating alerts and evidence into a single timeline. On the SC-200 exam, this question tests your ability to distinguish between the incident graph and other features like the device timeline or advanced hunting, which are text-based or query-driven rather than visual. A common trap is confusing the incident graph with the alert queue, but remember the graph is specifically designed for a bird’s-eye view of the attack story. Memory tip: think of the incident graph as the “crime scene map” for the attack—if you need to see the whole path at a glance, the graph is your answer.
SC-200 Mitigate threats using Microsoft Defender XDR Practice Question
This SC-200 practice question tests your understanding of mitigate threats using microsoft defender xdr. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. A key principle to apply: incident graph visually maps the attack chain and entity relationships.. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A security analyst is reviewing an incident in Microsoft 365 Defender where malware was detected on multiple endpoints. The analyst wants to see a visual representation of the attack progression, including the initial entry point and all affected devices. Which feature in the Microsoft 365 Defender portal should the analyst use?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Incident graph
The incident graph in Microsoft 365 Defender provides a visual, interactive map of the entire attack progression, showing the initial entry point, lateral movement, and all affected devices and users. It correlates alerts and evidence into a single timeline, enabling the analyst to understand the full scope of the incident at a glance. This directly meets the requirement for a visual representation of the attack progression.
Key principle: Incident graph visually maps the attack chain and entity relationships.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✓
Incident graph
Why this is correct
The incident graph visually maps the attack chain, showing entity relationships and progression.
Related concept
Incident graph visually maps the attack chain and entity relationships.
✗
Advanced hunting
Why it's wrong here
Advanced hunting is a query-based tool used for custom threat detection, not for a pre-built visual attack story.
✗
Threat analytics
Why it's wrong here
Threat analytics provides threat intelligence reports and adversary profiles, not incident-specific visualizations.
✗
Action center
Why it's wrong here
Action center lists pending and completed remediation actions, not the attack progression.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates confuse the incident graph (visual attack path) with Advanced hunting (raw data querying) because both are used for investigation, but only the graph provides a pre-built visual map of the attack progression.
Detailed technical explanation
How to think about this question
The incident graph uses a directed graph model where nodes represent entities (devices, users, mailboxes, IPs) and edges represent attack steps (e.g., execution, lateral movement). It automatically aggregates alerts from Microsoft Defender for Endpoint, Defender for Office 365, and other XDR components into a single incident, with the initial access alert typically marked as the root node. In a real-world scenario, an analyst might see a phishing email node connected to a user node, then to a device node where malware executed, and then to multiple other devices via RDP or SMB lateral movement, all color-coded by severity.
KKey Concepts to Remember
Incident graph visually maps the attack chain and entity relationships.
It correlates alerts, devices, users, and mailboxes within an incident.
Provides a timeline-based view of attack progression and scope.
Helps identify the initial entry point and all affected assets.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Incident graph visually maps the attack chain and entity relationships.
Real-world example
How this comes up in practice
A cloud solutions architect for a retail company is evaluating services for a new workload. The correct answer here reflects best practice for the specific scenario described — not a general cloud recommendation. Incident graph visually maps the attack chain and entity relationships. Cloud exam questions reward reading the constraint carefully: the same technology can be right or wrong depending on the use case.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this SC-200 question in full detail.
Review incident graph visually maps the attack chain and entity relationships., then practise related SC-200 questions on the same topic to reinforce the concept.
Mitigate threats using Microsoft Defender XDR — This question tests Mitigate threats using Microsoft Defender XDR — Incident graph visually maps the attack chain and entity relationships..
What is the correct answer to this question?
The correct answer is: Incident graph — The incident graph in Microsoft 365 Defender provides a visual, interactive map of the entire attack progression, showing the initial entry point, lateral movement, and all affected devices and users. It correlates alerts and evidence into a single timeline, enabling the analyst to understand the full scope of the incident at a glance. This directly meets the requirement for a visual representation of the attack progression.
What should I do if I get this SC-200 question wrong?
Review incident graph visually maps the attack chain and entity relationships., then practise related SC-200 questions on the same topic to reinforce the concept.
What is the key concept behind this question?
Incident graph visually maps the attack chain and entity relationships.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.