Investigating Security Incidents with the Investigation Graph
Your organization uses Microsoft Sentinel. You receive an incident that involves a potential lateral movement detected by Microsoft Defender for Identity. You need to investigate the timeline of the attack. Which Microsoft Sentinel feature should you use?
Quick Answer
The investigation graph is the correct choice because it provides a visual, interactive timeline of related alerts, entities, and activities, allowing you to trace the path of a potential lateral movement from initial access to the compromised endpoint. This feature maps out connections between users, devices, and alerts in a single view, making it ideal for reconstructing an attack sequence detected by Microsoft Defender for Identity. On the SC-200 exam, this question tests your ability to distinguish between investigation tools and automation or reporting features—a common trap is confusing the investigation graph with workbooks, which are for static reporting, or with analytics rules, which generate alerts but do not visualize incident timelines. Remember that the investigation graph is your go-to for dynamic, entity-based attack reconstruction, while automation rules handle response actions. A quick memory tip: think "graph for the path, workbook for the stats."
⚠ Common exam trap
Test-takers frequently confuse the Investigation graph with Workbooks, assuming any visual tool for analysis is a Workbook, but Workbooks are for aggregated reporting, not for per-incident entity timeline exploration.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Investigation graph
The Investigation graph in Microsoft Sentinel is specifically designed to explore the scope and timeline of an attack by visually mapping entities (e.g., users, devices, IPs) and their connections. For a lateral movement incident detected by Defender for Identity, the graph automatically surfaces related alerts, entities, and activities in a chronological view, enabling you to trace the attacker's path across resources. This makes it the correct tool for investigating the attack timeline.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Workbooks
Why it's wrong here
Workbooks are dashboards for visualising aggregated log data over time, not for stepping through a single incident's event sequence. They are tempting because they display timelines graphically, and would be correct if the requirement were ongoing monitoring or reporting rather than investigating one incident's attack progression.
- ✗
Automation rules
Why it's wrong here
Automation rules trigger playbooks or incident updates in response to incidents; they do not reconstruct an attack timeline. They are tempting because they act on the same Defender for Identity incident, and would be correct if the requirement were to automatically tag, assign or respond to incidents rather than investigate the sequence of events.
- ✓
Investigation graph
Why this is correct
The investigation graph visualises related entities, alerts and activities on a timeline, letting you trace the lateral movement path across accounts and hosts. It surfaces the attack chronology that a raw incident list or hunting query alone would not present as clearly.
- ✗
Analytics rules
Why it's wrong here
Analytics rules generate alerts and incidents from log queries; they detect activity rather than visualise an existing incident's event sequence. They are tempting because the Defender for Identity detection itself surfaces through such rules, and would be correct if the task were to create a new detection rather than investigate a timeline.
Go deeper
Related to this question
About these practice questions
This SC-200 question is part of Courseiva's 1,303-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SC-200
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Your organization uses Microsoft Sentinel. You are responsible for responding to incidents. A new 'MFA Denied' incident is created from Microsoft Entra ID sign-in logs, indicating that a user in your organization had multiple MFA denials from a suspicious IP address (203.0.113.5). The user is a sales representative who frequently travels. The incident severity is Medium. The incident contains entities: user 'jsmith@contoso.com', IP address 203.0.113.5, and a device running Windows 11. You need to investigate and determine if this is a true positive. The user is currently on a business trip in Europe, but the sign-in attempts originated from an IP address in a different region. What should you do first?
medium- A.Immediately reset the user's password and revoke sessions.
- ✓ B.Contact the user to confirm if they attempted to sign in at the time of the alerts.
- C.Block the suspicious IP address in the Conditional Access policy.
- D.Isolate the user's device using Microsoft Defender for Endpoint.
Why B: The first step in investigating a potential true positive is to contact the user to confirm if they attempted to sign in. This helps determine if the MFA denials were legitimate (e.g., user error) or malicious. It is a non-destructive action that gathers critical context.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.