SC-200 Practice Question 3752
Exam: SC-200
Domain: Respond to security incidents
Difficulty: easy
In Microsoft Sentinel, an incident is triggered by multiple failed logins followed by a successful brute-force sign-in. How can an analyst investigate the visual relationship between users, IPs, and cloud resources associated with this incident?
Answer Options
A
The interactive Investigation Graph
B
Windows Notepad text view
C
Exchange Message Trace delivery log
D
Azure Service Health dashboard
Correct Answer
A: The interactive Investigation Graph
Explanation
The "Investigate" graph button opens the interactive Investigation Graph, which visualizes connected entities, historical alerts, and correlations.