Use the Incident Investigation Graph in Microsoft Sentinel
Your SOC is investigating an incident in Microsoft Sentinel. You need to quickly identify all related alerts and entities across the timeline. What Microsoft Sentinel feature should you use?
Quick Answer
The answer is to open the incident investigation graph in Microsoft Sentinel. This feature is the correct choice because it provides a visual, interactive map that correlates all alerts, entities like users and IP addresses, and their relationships across a single timeline, enabling SOC analysts to instantly see the full scope of an incident without manual data correlation. On the SC-200 exam, this question tests your understanding of incident management workflows, often appearing as a scenario where you must distinguish the investigation graph from tools like the analytics rule wizard or entity behavior analytics—a common trap is confusing it with the hunting blade. For a quick memory tip, think of the investigation graph as your incident’s “relationship map”: if you need to connect dots across time and entities, graph it out.
⚠ Common exam trap
Test-takers frequently confuse the incident investigation graph with the Incident workbook, assuming both provide incident details, but the workbook is for aggregated reporting while the graph is for interactive, entity-level exploration of a single incident.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Open the incident investigation graph.
The incident investigation graph in Microsoft Sentinel provides a visual, interactive map of all alerts, entities (such as users, IP addresses, hosts), and their relationships linked to a specific incident. This allows SOC analysts to quickly see the full scope of an incident across the timeline without manually correlating data, making it the correct tool for this scenario.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Run a hunting query.
Why it's wrong here
Hunting is for proactive search.
- ✓
Open the incident investigation graph.
Why this is correct
Investigation graph shows relationships.
- ✗
Review the analytics rule that generated the incident.
Why it's wrong here
Analytics rules don't show related alerts.
- ✗
Use the Incident workbook.
Why it's wrong here
Workbooks are for reporting, not dynamic investigation.
Go deeper
Related to this question
About these practice questions
One of 209 original SC-200 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SC-200
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Your SOC team receives a high-priority incident related to a potential malware outbreak. You need to quickly identify all affected devices and users across the environment. What Microsoft Defender XDR feature should you use?
easy- A.Advanced hunting
- B.Action center
- ✓ C.Incident graph
- D.Microsoft Sentinel workbook
Why C: The incident graph visually maps the relationships between alerts, devices, users, and entities, enabling rapid identification of all affected devices and users during a high-priority incident. Option A is wrong because advanced hunting is query-based and slower for immediate triage. Option B is wrong because action center is for remediation actions, not for identifying affected assets. Option D is wrong because a Microsoft Sentinel workbook is for custom reporting and dashboards, not for real-time incident triage.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.