SC-200 Respond to security incidents Practice Question
You are investigating a security incident in Microsoft Sentinel. You want to visualize the relationships between entities such as IP addresses, users, and hosts. Which tool should you use?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Investigation graph
The Investigation graph in Microsoft Sentinel is specifically designed to visualize relationships between entities such as IP addresses, users, and hosts, making it the correct tool for this task. Analytics rules (B) are used for detection, automation rules (C) for automated responses, and workbooks (D) for dashboards and reporting, not for entity relationship visualization.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Investigation graph
Why this is correct
The investigation graph in Microsoft Sentinel renders entities such as IP addresses, users and hosts as connected nodes, exposing relationships and lateral movement paths visually. This satisfies the requirement to visualise entity relationships during incident investigation, unlike log queries or workbooks.
- ✗
Analytics rules
Why it's wrong here
Analytics rules generate alerts and incidents by matching scheduled or near-real-time queries against log data. They detect activity but do not render entity relationships. Investigation graphs, built from entities and their links, are the correct tool for visualising connections between IP addresses, users and hosts.
- ✗
Automation rules
Why it's wrong here
Automation rules trigger playbooks or modify incidents in response to alerts; they orchestrate actions rather than display data. They suit triage automation, such as assigning incidents or running remediation. Visualising relationships between entities requires the investigation graph, which maps entity links.
- ✗
Workbooks
Why it's wrong here
Workbooks present custom charts, metrics and dashboards from log queries; they show aggregate trends, not interactive entity links. They suit reporting and monitoring. Mapping relationships between IP addresses, users and hosts requires the investigation graph, which expands connected entities during an incident.
Go deeper
Related to this question
About these practice questions
One of 1,303 original SC-200 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.