Investigating Security Incidents with the Investigation Graph
Your organization uses Microsoft Sentinel. You receive an incident that involves a potential lateral movement detected by Microsoft Defender for Identity. You need to investigate the timeline of the attack. Which Microsoft Sentinel feature should you use?
Quick Answer
The investigation graph is the correct choice because it provides a visual, interactive timeline of related alerts, entities, and activities, allowing you to trace the path of a potential lateral movement from initial access to the compromised endpoint. This feature maps out connections between users, devices, and alerts in a single view, making it ideal for reconstructing an attack sequence detected by Microsoft Defender for Identity. On the SC-200 exam, this question tests your ability to distinguish between investigation tools and automation or reporting features—a common trap is confusing the investigation graph with workbooks, which are for static reporting, or with analytics rules, which generate alerts but do not visualize incident timelines. Remember that the investigation graph is your go-to for dynamic, entity-based attack reconstruction, while automation rules handle response actions. A quick memory tip: think "graph for the path, workbook for the stats."
⚠ Common exam trap
Test-takers frequently confuse the Investigation graph with Workbooks, assuming any visual tool for analysis is a Workbook, but Workbooks are for aggregated reporting, not for per-incident entity timeline exploration.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Investigation graph
The Investigation graph in Microsoft Sentinel is specifically designed to explore the scope and timeline of an attack by visually mapping entities (e.g., users, devices, IPs) and their connections. For a lateral movement incident detected by Defender for Identity, the graph automatically surfaces related alerts, entities, and activities in a chronological view, enabling you to trace the attacker's path across resources. This makes it the correct tool for investigating the attack timeline.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Workbooks
Why it's wrong here
For reporting, not investigation.
- ✗
Automation rules
Why it's wrong here
Trigger playbooks.
- ✓
Investigation graph
Why this is correct
Visual timeline for investigation.
- ✗
Analytics rules
Why it's wrong here
Generate alerts.
Go deeper
Related to this question
About these practice questions
This SC-200 question is part of Courseiva's 209-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SC-200
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Your organization uses Microsoft Sentinel. You are responsible for responding to incidents. A new 'MFA Denied' incident is created from Microsoft Entra ID sign-in logs, indicating that a user in your organization had multiple MFA denials from a suspicious IP address (203.0.113.5). The user is a sales representative who frequently travels. The incident severity is Medium. The incident contains entities: user 'jsmith@contoso.com', IP address 203.0.113.5, and a device running Windows 11. You need to investigate and determine if this is a true positive. The user is currently on a business trip in Europe, but the sign-in attempts originated from an IP address in a different region. What should you do first?
medium- A.Immediately reset the user's password and revoke sessions.
- ✓ B.Contact the user to confirm if they attempted to sign in at the time of the alerts.
- C.Block the suspicious IP address in the Conditional Access policy.
- D.Isolate the user's device using Microsoft Defender for Endpoint.
Why B: Verifying with the user if they attempted to sign in is the fastest way to confirm if the MFA denials were legitimate. Option A is wrong because changing the password prematurely may lock out the user without confirmation. Option C is wrong because containing the device may disrupt the user's work. Option D is wrong because blocking the IP may be premature if the user's IP changes frequently.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.