SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
Your organization uses Microsoft Defender XDR. You need to investigate a potential lateral movement attack where a compromised user account is used to access multiple workstations. Which feature should you use to visualize the attack path?
⚠ Common exam trap
Many candidates confuse the attack graph with the incident queue or threat analytics, assuming any security dashboard can visualize attack paths, but only the attack graph provides the automated, graph-based lateral movement visualization specific to Defender XDR.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Attack graph
Attack graph in Microsoft Defender XDR is the correct feature because it automatically maps and visualizes the potential paths an attacker could take to move laterally across devices using compromised credentials. It correlates alerts and incidents to show the sequence of events, such as a user account authenticating to multiple workstations, enabling security teams to identify the scope and entry point of the attack.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Attack graph
Why this is correct
The Attack graph in Microsoft Defender XDR specifically visualizes the full scope of an attack, including how an attacker moved laterally, which assets were impacted, and the relationships between entities. It provides a rich, interactive representation of the attack chain, making it ideal for understanding lateral movement paths and identifying potential pivot points. This feature is crucial for incident responders to trace the progression of sophisticated threats.
- ✗
Microsoft Sentinel workbooks
Why it's wrong here
Microsoft Sentinel workbooks are powerful, customizable dashboards built on Azure Monitor Workbooks, used for data visualization, reporting, and interactive analysis of security data. While they can display data related to incidents or entity behavior, they are primarily for presenting aggregated information and custom queries, not for dynamically mapping and visualizing real-time attack paths or lateral movement in the way a dedicated attack graph does. They require manual configuration to represent attack flow, rather than automatically generating it.
- ✗
Threat analytics in Microsoft 365 Defender
Why it's wrong here
Threat analytics in Microsoft Defender XDR provides expert-backed reports and insights into active threats, vulnerabilities, and attack campaigns affecting an organization. It focuses on providing threat intelligence, detailing adversary tactics, techniques, and procedures (TTPs), and offering recommendations for mitigation. While valuable for understanding the broader threat landscape, it does not dynamically visualize the specific lateral movement or attack paths within *your* organization's environment during an active incident.
- ✗
Incident queue
Why it's wrong here
The incident queue in Microsoft Defender XDR serves as a centralized list of all detected security incidents, providing an overview of their status, severity, and assigned analyst. Its primary function is for incident management, allowing security teams to triage, investigate, and manage multiple related alerts as a single incident. While an incident might contain alerts that *contribute* to an attack path, the queue itself is merely a list and does not visually represent the intricate lateral movement or the full attack chain.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Scope
In IT, scope defines the boundaries, goals, and deliverables of a project, assessment, or engagement, specifying what is included and what is excluded.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.