SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
A security analyst receives an alert from Microsoft Sentinel indicating a potential ransomware attack. The analyst needs to quickly understand the full scope of the attack, including all affected accounts and devices. Which Microsoft Sentinel feature should they use?
⚠ Common exam trap
It's easy for candidates to confuse 'incident investigation' with 'workbooks' or 'playbooks,' assuming that any visual tool or automated action can provide attack scope, when in fact only the investigation graph offers entity-level relationship mapping for a specific incident.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Incident investigation
D is correct because Microsoft Sentinel's incident investigation feature provides a visual, interactive graph that maps relationships between entities (e.g., accounts, devices, IP addresses) involved in an incident. This allows the analyst to quickly see the full scope of a ransomware attack by exploring all affected resources and their connections, rather than relying on static reports or automated responses.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Analytics rules
Why it's wrong here
Analytics rules in Microsoft Sentinel are fundamental for threat detection, defining the logic (KQL queries) and scheduling that generate security alerts and incidents from ingested data. They are configured to identify specific patterns or anomalies, effectively creating the initial notification that a security analyst receives. However, these rules do not provide an interface or tools for the subsequent interactive investigation of an alert's context, scope, or related entities once it has been triggered.
- ✗
Workbooks
Why it's wrong here
Microsoft Sentinel Workbooks are interactive dashboards built on Azure Monitor Workbooks, primarily designed for data visualization, reporting, and monitoring security posture. They enable analysts to create custom, dynamic views of their security data, track trends, and present findings effectively. While valuable for gaining insights and displaying information, Workbooks are not an interactive environment specifically tailored for the deep-dive, entity-centric exploration required to investigate a specific security alert's relationships and attack chain.
- ✗
Playbooks
Why it's wrong here
Playbooks in Microsoft Sentinel are automated response workflows, implemented using Azure Logic Apps, designed to execute predefined actions when triggered by an alert or incident. Their core function is to orchestrate automated remediation, enrichment, or response tasks, such as blocking malicious IPs or gathering additional data. While they can contribute data to an investigation, playbooks do not offer the interactive graphical interface or manual exploration capabilities that a security analyst needs to understand the full scope and context of an attack.
- ✓
Incident investigation
Why this is correct
The incident investigation graph in Microsoft Sentinel is a crucial tool that provides security analysts with a visual, interactive representation of an alert or incident's scope and context. It dynamically maps entities like users, hosts, and IP addresses, showing their relationships and connections to related alerts and events. This graphical view is essential for understanding the attack chain, identifying affected assets, and effectively determining the overall impact and progression of a security event.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Ransomware
Ransomware is a type of malicious software that encrypts a victim's files or locks them out of their system, demanding payment, usually in cryptocurrency, to restore access.
About these practice questions
This SC-900 question is part of Courseiva's 1,250-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.