Practice Exams:

View All

Microsoft SC-200 Hunting Graphs Blast RADIUS And Sentinel Graph Practice Test

Skills 3.1 • 30 original questions

This Microsoft SC-200 Security Operations Analyst practice test focuses on hunting graphs blast radius and sentinel graph through original scenario-based questions aligned to the skills measured as of July 28, 2026. Use the full ExamSnap SC-200 collection for broader practice across the current Defender XDR, Microsoft Sentinel, incident-response, and threat-hunting skill areas. For broader exam preparation, review the Microsoft SC-200 Exam Dumps page.

Instructions: Select the best answer for each question. Review the explanation after answering; each distractor includes a reason it is not the best choice for that scenario.

Question 1

During a ransomware response at Fabrikam Retail, the SOC analyst must visualize connected entities and estimate the blast radius of the suspected attack. Which action most directly satisfies the requirement for the identity-response team, response wave 1? The design priority is to preserve investigation context.

Select the Microsoft Defender XDR or Sentinel table whose schema contains the event type needed for the hunt
Write or refine the KQL query so it filters, correlates, summarizes, or joins the security data needed to expose the suspected threat pattern
Create or use the hunting graph to visualize connected entities and assess the incident blast radius
Use Microsoft Defender XDR threat analytics to understand the active threat, affected products, exposure, and recommended mitigations
Use a Microsoft Sentinel notebook and, when required, connect it to the Sentinel MCP Server for the advanced hunting workflow

Correct answer: C

Why: Hunting graphs help analysts reason about entity relationships and visualize how an attack may have spread across connected assets. This directly addresses the requirement: visualize connected entities and estimate the blast radius of the suspected attack.

Option review:

A: Effective KQL hunting starts with the correct table because device, identity, email, cloud, and other event families are stored in different schemas. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: visualize connected entities and estimate the blast radius of the suspected attack.

B: KQL is the query language used to analyze large security datasets and supports filtering, aggregation, parsing, joins, and time-based correlation for threat hunting. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: visualize connected entities and estimate the blast radius of the suspected attack.

C: Hunting graphs help analysts reason about entity relationships and visualize how an attack may have spread across connected assets. This directly addresses the requirement: visualize connected entities and estimate the blast radius of the suspected attack.

D: Threat analytics provides curated intelligence and organizational exposure context so analysts can understand relevant campaigns and prioritize mitigation. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: visualize connected entities and estimate the blast radius of the suspected attack.

E: Sentinel notebooks support programmable investigation and hunting workflows, including data science and AI-assisted integrations such as the Sentinel MCP Server. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: visualize connected entities and estimate the blast radius of the suspected attack.

Learning point: Create or use the hunting graph to visualize connected entities and assess the incident blast radius

Question 2

Adventure Works is revising its SOC runbook after a threat-hunting campaign. Analysts need to analyze relationships among security entities by using the Sentinel graph view. Which implementation should the Defender administrator select for the endpoint-response team, response wave 1 while trying to minimize manual analyst steps?

Create and validate the Advanced Hunting query in Microsoft Defender XDR for the stated hunting hypothesis
Create or manage a Summary rule that materializes the required aggregated data into a summary table
Use Sentinel Graph to explore relationships between the relevant security entities
Create or manage the Microsoft Sentinel Data Lake KQL job for the required large-scale or historical processing task
Use Microsoft Defender XDR threat analytics to understand the active threat, affected products, exposure, and recommended mitigations

Correct answer: C

Why: Sentinel Graph exposes entity relationships so analysts can pivot through connections that are difficult to understand from isolated log rows. This directly addresses the requirement: analyze relationships among security entities by using the Sentinel graph view.

Option review:

A: Advanced Hunting provides cross-domain Defender data that can be queried with KQL to test hypotheses and investigate suspicious activity across supported entities. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: analyze relationships among security entities by using the Sentinel graph view.

B: Summary rules pre-aggregate selected data into tables that can improve query performance and make recurring analytical patterns easier to query. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: analyze relationships among security entities by using the Sentinel graph view.

C: Sentinel Graph exposes entity relationships so analysts can pivot through connections that are difficult to understand from isolated log rows. This directly addresses the requirement: analyze relationships among security entities by using the Sentinel graph view.

D: KQL jobs in the Sentinel Data Lake support scheduled or managed processing over data retained in the lake and are appropriate when the hunt depends on data-lake scale or history. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: analyze relationships among security entities by using the Sentinel graph view.

E: Threat analytics provides curated intelligence and organizational exposure context so analysts can understand relevant campaigns and prioritize mitigation. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: analyze relationships among security entities by using the Sentinel graph view.

Learning point: Use Sentinel Graph to explore relationships between the relevant security entities

Question 3

A ticket escalated to the threat hunter at Alpine Ski House states one non-negotiable goal: visualize connected entities and estimate the blast radius of the suspected attack. Which choice is the strongest fit for the messaging-security team, response wave 2? The team also wants to minimize manual analyst steps.

Use Sentinel Graph to explore relationships between the relevant security entities
Use Microsoft Defender XDR threat analytics to understand the active threat, affected products, exposure, and recommended mitigations
Create or use the hunting graph to visualize connected entities and assess the incident blast radius
Write or refine the KQL query so it filters, correlates, summarizes, or joins the security data needed to expose the suspected threat pattern
Use a Microsoft Sentinel notebook and, when required, connect it to the Sentinel MCP Server for the advanced hunting workflow

Correct answer: C

Option review:

A: Sentinel Graph exposes entity relationships so analysts can pivot through connections that are difficult to understand from isolated log rows. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: visualize connected entities and estimate the blast radius of the suspected attack.

B: Threat analytics provides curated intelligence and organizational exposure context so analysts can understand relevant campaigns and prioritize mitigation. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: visualize connected entities and estimate the blast radius of the suspected attack.

D: KQL is the query language used to analyze large security datasets and supports filtering, aggregation, parsing, joins, and time-based correlation for threat hunting. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: visualize connected entities and estimate the blast radius of the suspected attack.

Learning point: Create or use the hunting graph to visualize connected entities and assess the incident blast radius

Question 4

For the night shift, response wave 2 at Wide World Importers, a post-incident review can proceed only if the team can analyze relationships among security entities by using the Sentinel graph view. What should the SOC analyst configure first if the operational goal is to retain evidence for follow-up analysis?

Create or use the hunting graph to visualize connected entities and assess the incident blast radius
Use Microsoft Defender XDR threat analytics to understand the active threat, affected products, exposure, and recommended mitigations
Write or refine the KQL query so it filters, correlates, summarizes, or joins the security data needed to expose the suspected threat pattern
Use Sentinel Graph to explore relationships between the relevant security entities
Select the Microsoft Defender XDR or Sentinel table whose schema contains the event type needed for the hunt

Correct answer: D

Option review:

A: Hunting graphs help analysts reason about entity relationships and visualize how an attack may have spread across connected assets. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: analyze relationships among security entities by using the Sentinel graph view.

B: Threat analytics provides curated intelligence and organizational exposure context so analysts can understand relevant campaigns and prioritize mitigation. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: analyze relationships among security entities by using the Sentinel graph view.

C: KQL is the query language used to analyze large security datasets and supports filtering, aggregation, parsing, joins, and time-based correlation for threat hunting. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: analyze relationships among security entities by using the Sentinel graph view.

D: Sentinel Graph exposes entity relationships so analysts can pivot through connections that are difficult to understand from isolated log rows. This directly addresses the requirement: analyze relationships among security entities by using the Sentinel graph view.

E: Effective KQL hunting starts with the correct table because device, identity, email, cloud, and other event families are stored in different schemas. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: analyze relationships among security entities by using the Sentinel graph view.

Learning point: Use Sentinel Graph to explore relationships between the relevant security entities

Question 5

The security architecture review at Lucerne Publishing focuses on this requirement: visualize connected entities and estimate the blast radius of the suspected attack. Which Microsoft security action is most appropriate for the Americas SOC, response wave 3, given the need to retain evidence for follow-up analysis?

Use Sentinel Graph to explore relationships between the relevant security entities
Write or refine the KQL query so it filters, correlates, summarizes, or joins the security data needed to expose the suspected threat pattern
Select the Microsoft Defender XDR or Sentinel table whose schema contains the event type needed for the hunt
Create or use the hunting graph to visualize connected entities and assess the incident blast radius
Create and validate the Advanced Hunting query in Microsoft Defender XDR for the stated hunting hypothesis

Correct answer: D

Option review:

C: Effective KQL hunting starts with the correct table because device, identity, email, cloud, and other event families are stored in different schemas. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: visualize connected entities and estimate the blast radius of the suspected attack.

D: Hunting graphs help analysts reason about entity relationships and visualize how an attack may have spread across connected assets. This directly addresses the requirement: visualize connected entities and estimate the blast radius of the suspected attack.

E: Advanced Hunting provides cross-domain Defender data that can be queried with KQL to test hypotheses and investigate suspicious activity across supported entities. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: visualize connected entities and estimate the blast radius of the suspected attack.

Learning point: Create or use the hunting graph to visualize connected entities and assess the incident blast radius

Question 6

A change advisory board at Northwind Traders asks how to analyze relationships among security entities by using the Sentinel graph view during a detection-engineering sprint. Which proposed action should the threat hunter approve for the high-value-assets group, response wave 3? The change should avoid unnecessary alert noise.

Create and validate the Advanced Hunting query in Microsoft Defender XDR for the stated hunting hypothesis
Create or manage a Summary rule that materializes the required aggregated data into a summary table
Use Microsoft Defender XDR threat analytics to understand the active threat, affected products, exposure, and recommended mitigations
Use Sentinel Graph to explore relationships between the relevant security entities
Create the Microsoft Sentinel hunting query and monitor its results for recurring or emerging suspicious activity

Correct answer: D

Option review:

C: Threat analytics provides curated intelligence and organizational exposure context so analysts can understand relevant campaigns and prioritize mitigation. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: analyze relationships among security entities by using the Sentinel graph view.

E: Sentinel hunting queries support repeatable proactive searches across the workspace and can be monitored as the analyst develops and refines the hunting hypothesis. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: analyze relationships among security entities by using the Sentinel graph view.

Learning point: Use Sentinel Graph to explore relationships between the relevant security entities

Question 7

Woodgrove Bank has ruled out a manual one-off workaround. For the server fleet, response wave 4, the remaining requirement is to visualize connected entities and estimate the blast radius of the suspected attack. Which choice best addresses it and helps avoid unnecessary alert noise?

Select the Microsoft Defender XDR or Sentinel table whose schema contains the event type needed for the hunt
Create or manage a Summary rule that materializes the required aggregated data into a summary table
Create or use the hunting graph to visualize connected entities and assess the incident blast radius
Use Microsoft Defender XDR threat analytics to understand the active threat, affected products, exposure, and recommended mitigations
Use a Microsoft Sentinel notebook and, when required, connect it to the Sentinel MCP Server for the advanced hunting workflow

Correct answer: C

Option review:

B: Summary rules pre-aggregate selected data into tables that can improve query performance and make recurring analytical patterns easier to query. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: visualize connected entities and estimate the blast radius of the suspected attack.

Learning point: Create or use the hunting graph to visualize connected entities and assess the incident blast radius

Question 8

During post-incident review at Blue Yonder Airlines, the Tier 2 analyst identifies a gap: the SOC still needs to analyze relationships among security entities by using the Sentinel graph view. Which action should be added for the remote-user fleet, response wave 4 before the next incident, with an emphasis on trying to preserve least privilege?

Use Sentinel Graph to explore relationships between the relevant security entities
Create the Microsoft Sentinel hunting query and monitor its results for recurring or emerging suspicious activity
Create and validate the Advanced Hunting query in Microsoft Defender XDR for the stated hunting hypothesis
Create or manage a Summary rule that materializes the required aggregated data into a summary table
Write or refine the KQL query so it filters, correlates, summarizes, or joins the security data needed to expose the suspected threat pattern

Correct answer: A

Option review:

A: Sentinel Graph exposes entity relationships so analysts can pivot through connections that are difficult to understand from isolated log rows. This directly addresses the requirement: analyze relationships among security entities by using the Sentinel graph view.

B: Sentinel hunting queries support repeatable proactive searches across the workspace and can be monitored as the analyst develops and refines the hunting hypothesis. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: analyze relationships among security entities by using the Sentinel graph view.

C: Advanced Hunting provides cross-domain Defender data that can be queried with KQL to test hypotheses and investigate suspicious activity across supported entities. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: analyze relationships among security entities by using the Sentinel graph view.

D: Summary rules pre-aggregate selected data into tables that can improve query performance and make recurring analytical patterns easier to query. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: analyze relationships among security entities by using the Sentinel graph view.

E: KQL is the query language used to analyze large security datasets and supports filtering, aggregation, parsing, joins, and time-based correlation for threat hunting. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: analyze relationships among security entities by using the Sentinel graph view.

Learning point: Use Sentinel Graph to explore relationships between the relevant security entities

Question 9

The Sentinel administrator at A. Datum is comparing several Microsoft security options for a audit investigation. Which one directly enables the team to visualize connected entities and estimate the blast radius of the suspected attack for the research subscription, response wave 5 while helping preserve least privilege?

Create or use the hunting graph to visualize connected entities and assess the incident blast radius
Use Microsoft Defender XDR threat analytics to understand the active threat, affected products, exposure, and recommended mitigations
Select the Microsoft Defender XDR or Sentinel table whose schema contains the event type needed for the hunt
Write or refine the KQL query so it filters, correlates, summarizes, or joins the security data needed to expose the suspected threat pattern
Use a Microsoft Sentinel notebook and, when required, connect it to the Sentinel MCP Server for the advanced hunting workflow

Correct answer: A

Option review:

A: Hunting graphs help analysts reason about entity relationships and visualize how an attack may have spread across connected assets. This directly addresses the requirement: visualize connected entities and estimate the blast radius of the suspected attack.

Learning point: Create or use the hunting graph to visualize connected entities and assess the incident blast radius

Question 10

A security-operations workshop at Contoso Health defines the desired outcome as follows: analyze relationships among security entities by using the Sentinel graph view. Which implementation should be chosen for the regulated workload segment, response wave 5? The team wants to reduce mean time to respond.

Use a Microsoft Sentinel notebook and, when required, connect it to the Sentinel MCP Server for the advanced hunting workflow
Create or manage the Microsoft Sentinel Data Lake KQL job for the required large-scale or historical processing task
Write or refine the KQL query so it filters, correlates, summarizes, or joins the security data needed to expose the suspected threat pattern
Use Sentinel Graph to explore relationships between the relevant security entities
Create or use the hunting graph to visualize connected entities and assess the incident blast radius

Correct answer: D

Option review:

A: Sentinel notebooks support programmable investigation and hunting workflows, including data science and AI-assisted integrations such as the Sentinel MCP Server. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: analyze relationships among security entities by using the Sentinel graph view.

B: KQL jobs in the Sentinel Data Lake support scheduled or managed processing over data retained in the lake and are appropriate when the hunt depends on data-lake scale or history. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: analyze relationships among security entities by using the Sentinel graph view.

E: Hunting graphs help analysts reason about entity relationships and visualize how an attack may have spread across connected assets. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: analyze relationships among security entities by using the Sentinel graph view.

Learning point: Use Sentinel Graph to explore relationships between the relevant security entities

Question 11

Which Microsoft security action best matches this technical purpose for the Tier 2 queue, response wave 6: Hunting graphs help analysts reason about entity relationships and visualize how an attack may have spread across connected assets. The SOC is trying to reduce mean time to respond.

Write or refine the KQL query so it filters, correlates, summarizes, or joins the security data needed to expose the suspected threat pattern
Create or use the hunting graph to visualize connected entities and assess the incident blast radius
Create or manage a Summary rule that materializes the required aggregated data into a summary table
Create or manage the Microsoft Sentinel Data Lake KQL job for the required large-scale or historical processing task
Use a Microsoft Sentinel notebook and, when required, connect it to the Sentinel MCP Server for the advanced hunting workflow

Correct answer: B

Option review:

A: KQL is the query language used to analyze large security datasets and supports filtering, aggregation, parsing, joins, and time-based correlation for threat hunting. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: visualize connected entities and estimate the blast radius of the suspected attack.

B: Hunting graphs help analysts reason about entity relationships and visualize how an attack may have spread across connected assets. This directly addresses the requirement: visualize connected entities and estimate the blast radius of the suspected attack.

C: Summary rules pre-aggregate selected data into tables that can improve query performance and make recurring analytical patterns easier to query. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: visualize connected entities and estimate the blast radius of the suspected attack.

D: KQL jobs in the Sentinel Data Lake support scheduled or managed processing over data retained in the lake and are appropriate when the hunt depends on data-lake scale or history. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: visualize connected entities and estimate the blast radius of the suspected attack.

Learning point: Create or use the hunting graph to visualize connected entities and assess the incident blast radius

Question 12

An analyst at Proseware Services describes the needed capability this way: Sentinel Graph exposes entity relationships so analysts can pivot through connections that are difficult to understand from isolated log rows. Which option should be associated with that requirement for the identity-response team, response wave 6 while the team tries to scope the change to the affected security domain?

Select the Microsoft Defender XDR or Sentinel table whose schema contains the event type needed for the hunt
Create and validate the Advanced Hunting query in Microsoft Defender XDR for the stated hunting hypothesis
Create the Microsoft Sentinel hunting query and monitor its results for recurring or emerging suspicious activity
Create or use the hunting graph to visualize connected entities and assess the incident blast radius
Use Sentinel Graph to explore relationships between the relevant security entities

Correct answer: E

Option review:

A: Effective KQL hunting starts with the correct table because device, identity, email, cloud, and other event families are stored in different schemas. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: analyze relationships among security entities by using the Sentinel graph view.

B: Advanced Hunting provides cross-domain Defender data that can be queried with KQL to test hypotheses and investigate suspicious activity across supported entities. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: analyze relationships among security entities by using the Sentinel graph view.

C: Sentinel hunting queries support repeatable proactive searches across the workspace and can be monitored as the analyst develops and refines the hunting hypothesis. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: analyze relationships among security entities by using the Sentinel graph view.

D: Hunting graphs help analysts reason about entity relationships and visualize how an attack may have spread across connected assets. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: analyze relationships among security entities by using the Sentinel graph view.

E: Sentinel Graph exposes entity relationships so analysts can pivot through connections that are difficult to understand from isolated log rows. This directly addresses the requirement: analyze relationships among security entities by using the Sentinel graph view.

Learning point: Use Sentinel Graph to explore relationships between the relevant security entities

Question 13

During a design validation for the cloud-security team, response wave 7, Wide World Importers documents the following behavior: Hunting graphs help analysts reason about entity relationships and visualize how an attack may have spread across connected assets. Which Microsoft security feature or action is being described? The objective is to scope the change to the affected security domain.

Use Microsoft Defender XDR threat analytics to understand the active threat, affected products, exposure, and recommended mitigations
Create or manage the Microsoft Sentinel Data Lake KQL job for the required large-scale or historical processing task
Use a Microsoft Sentinel notebook and, when required, connect it to the Sentinel MCP Server for the advanced hunting workflow
Create or use the hunting graph to visualize connected entities and assess the incident blast radius
Use Sentinel Graph to explore relationships between the relevant security entities

Correct answer: D

Option review:

A: Threat analytics provides curated intelligence and organizational exposure context so analysts can understand relevant campaigns and prioritize mitigation. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: visualize connected entities and estimate the blast radius of the suspected attack.

B: KQL jobs in the Sentinel Data Lake support scheduled or managed processing over data retained in the lake and are appropriate when the hunt depends on data-lake scale or history. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: visualize connected entities and estimate the blast radius of the suspected attack.

C: Sentinel notebooks support programmable investigation and hunting workflows, including data science and AI-assisted integrations such as the Sentinel MCP Server. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: visualize connected entities and estimate the blast radius of the suspected attack.

E: Sentinel Graph exposes entity relationships so analysts can pivot through connections that are difficult to understand from isolated log rows. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: visualize connected entities and estimate the blast radius of the suspected attack.

Learning point: Create or use the hunting graph to visualize connected entities and assess the incident blast radius

Question 14

The security operations analyst must identify the Microsoft security capability that provides this function for the messaging-security team, response wave 7: Sentinel Graph exposes entity relationships so analysts can pivot through connections that are difficult to understand from isolated log rows. Which choice is correct if the SOC also needs to keep the workflow auditable?

Create or manage a Summary rule that materializes the required aggregated data into a summary table
Use Sentinel Graph to explore relationships between the relevant security entities
Select the Microsoft Defender XDR or Sentinel table whose schema contains the event type needed for the hunt
Create and validate the Advanced Hunting query in Microsoft Defender XDR for the stated hunting hypothesis
Create or manage the Microsoft Sentinel Data Lake KQL job for the required large-scale or historical processing task

Correct answer: B

Option review:

A: Summary rules pre-aggregate selected data into tables that can improve query performance and make recurring analytical patterns easier to query. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: analyze relationships among security entities by using the Sentinel graph view.

B: Sentinel Graph exposes entity relationships so analysts can pivot through connections that are difficult to understand from isolated log rows. This directly addresses the requirement: analyze relationships among security entities by using the Sentinel graph view.

C: Effective KQL hunting starts with the correct table because device, identity, email, cloud, and other event families are stored in different schemas. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: analyze relationships among security entities by using the Sentinel graph view.

D: Advanced Hunting provides cross-domain Defender data that can be queried with KQL to test hypotheses and investigate suspicious activity across supported entities. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: analyze relationships among security entities by using the Sentinel graph view.

E: KQL jobs in the Sentinel Data Lake support scheduled or managed processing over data retained in the lake and are appropriate when the hunt depends on data-lake scale or history. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: analyze relationships among security entities by using the Sentinel graph view.

Learning point: Use Sentinel Graph to explore relationships between the relevant security entities

Question 15

A runbook for the EMEA SOC, response wave 8 contains this description: Hunting graphs help analysts reason about entity relationships and visualize how an attack may have spread across connected assets. Which implementation belongs in that runbook during a multi-cloud monitoring rollout? The process should keep the workflow auditable.

Create or use the hunting graph to visualize connected entities and assess the incident blast radius
Use Microsoft Defender XDR threat analytics to understand the active threat, affected products, exposure, and recommended mitigations
Write or refine the KQL query so it filters, correlates, summarizes, or joins the security data needed to expose the suspected threat pattern
Create and validate the Advanced Hunting query in Microsoft Defender XDR for the stated hunting hypothesis
Create the Microsoft Sentinel hunting query and monitor its results for recurring or emerging suspicious activity

Correct answer: A

Option review:

C: KQL is the query language used to analyze large security datasets and supports filtering, aggregation, parsing, joins, and time-based correlation for threat hunting. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: visualize connected entities and estimate the blast radius of the suspected attack.

D: Advanced Hunting provides cross-domain Defender data that can be queried with KQL to test hypotheses and investigate suspicious activity across supported entities. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: visualize connected entities and estimate the blast radius of the suspected attack.

E: Sentinel hunting queries support repeatable proactive searches across the workspace and can be monitored as the analyst develops and refines the hunting hypothesis. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: visualize connected entities and estimate the blast radius of the suspected attack.

Learning point: Create or use the hunting graph to visualize connected entities and assess the incident blast radius

Question 16

Tailspin Toys is troubleshooting a ransomware response. Evidence shows that the decisive requirement is to analyze relationships among security entities by using the Sentinel graph view. Which action should the incident responder investigate first for the Americas SOC, response wave 8, without losing the ability to avoid changing an unrelated control plane?

Use Microsoft Defender XDR threat analytics to understand the active threat, affected products, exposure, and recommended mitigations
Use Sentinel Graph to explore relationships between the relevant security entities
Use a Microsoft Sentinel notebook and, when required, connect it to the Sentinel MCP Server for the advanced hunting workflow
Create or use the hunting graph to visualize connected entities and assess the incident blast radius
Create the Microsoft Sentinel hunting query and monitor its results for recurring or emerging suspicious activity

Correct answer: B

Option review:

A: Threat analytics provides curated intelligence and organizational exposure context so analysts can understand relevant campaigns and prioritize mitigation. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: analyze relationships among security entities by using the Sentinel graph view.

C: Sentinel notebooks support programmable investigation and hunting workflows, including data science and AI-assisted integrations such as the Sentinel MCP Server. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: analyze relationships among security entities by using the Sentinel graph view.

Learning point: Use Sentinel Graph to explore relationships between the relevant security entities

Question 17

After eliminating network and licensing causes, the SOC analyst at Blue Yonder Airlines determines that success depends on the ability to visualize connected entities and estimate the blast radius of the suspected attack. Which security action should be checked next for the privileged-users group, response wave 9? The team must avoid changing an unrelated control plane.

Select the Microsoft Defender XDR or Sentinel table whose schema contains the event type needed for the hunt
Create or use the hunting graph to visualize connected entities and assess the incident blast radius
Use Sentinel Graph to explore relationships between the relevant security entities
Create the Microsoft Sentinel hunting query and monitor its results for recurring or emerging suspicious activity
Create or manage a Summary rule that materializes the required aggregated data into a summary table

Correct answer: B

Option review:

C: Sentinel Graph exposes entity relationships so analysts can pivot through connections that are difficult to understand from isolated log rows. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: visualize connected entities and estimate the blast radius of the suspected attack.

D: Sentinel hunting queries support repeatable proactive searches across the workspace and can be monitored as the analyst develops and refines the hunting hypothesis. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: visualize connected entities and estimate the blast radius of the suspected attack.

E: Summary rules pre-aggregate selected data into tables that can improve query performance and make recurring analytical patterns easier to query. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: visualize connected entities and estimate the blast radius of the suspected attack.

Learning point: Create or use the hunting graph to visualize connected entities and assess the incident blast radius

Question 18

A service-desk escalation during a phishing investigation has been narrowed to one security-operations requirement: analyze relationships among security entities by using the Sentinel graph view. Which configuration is the most relevant starting point for the server fleet, response wave 9 if the SOC wants to improve detection coverage?

Create and validate the Advanced Hunting query in Microsoft Defender XDR for the stated hunting hypothesis
Create or manage the Microsoft Sentinel Data Lake KQL job for the required large-scale or historical processing task
Select the Microsoft Defender XDR or Sentinel table whose schema contains the event type needed for the hunt
Use Sentinel Graph to explore relationships between the relevant security entities
Write or refine the KQL query so it filters, correlates, summarizes, or joins the security data needed to expose the suspected threat pattern

Correct answer: D

Option review:

C: Effective KQL hunting starts with the correct table because device, identity, email, cloud, and other event families are stored in different schemas. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: analyze relationships among security entities by using the Sentinel graph view.

Learning point: Use Sentinel Graph to explore relationships between the relevant security entities

Question 19

The failure pattern at Contoso Health affects the production subscription, response wave 10. Before making unrelated policy changes, the threat hunter needs a solution that will visualize connected entities and estimate the blast radius of the suspected attack. Which action is most directly relevant and helps improve detection coverage?

Create the Microsoft Sentinel hunting query and monitor its results for recurring or emerging suspicious activity
Create or use the hunting graph to visualize connected entities and assess the incident blast radius
Select the Microsoft Defender XDR or Sentinel table whose schema contains the event type needed for the hunt
Create and validate the Advanced Hunting query in Microsoft Defender XDR for the stated hunting hypothesis
Write or refine the KQL query so it filters, correlates, summarizes, or joins the security data needed to expose the suspected threat pattern

Correct answer: B

Option review:

A: Sentinel hunting queries support repeatable proactive searches across the workspace and can be monitored as the analyst develops and refines the hunting hypothesis. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: visualize connected entities and estimate the blast radius of the suspected attack.

D: Advanced Hunting provides cross-domain Defender data that can be queried with KQL to test hypotheses and investigate suspicious activity across supported entities. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: visualize connected entities and estimate the blast radius of the suspected attack.

E: KQL is the query language used to analyze large security datasets and supports filtering, aggregation, parsing, joins, and time-based correlation for threat hunting. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: visualize connected entities and estimate the blast radius of the suspected attack.

Learning point: Create or use the hunting graph to visualize connected entities and assess the incident blast radius

Question 20

While investigating a SOC handoff review, Litware Manufacturing confirms the environment must analyze relationships among security entities by using the Sentinel graph view. Which Microsoft security capability should be validated for the research subscription, response wave 10? The investigation should support repeatable response.

Select the Microsoft Defender XDR or Sentinel table whose schema contains the event type needed for the hunt
Write or refine the KQL query so it filters, correlates, summarizes, or joins the security data needed to expose the suspected threat pattern
Create or use the hunting graph to visualize connected entities and assess the incident blast radius
Create the Microsoft Sentinel hunting query and monitor its results for recurring or emerging suspicious activity
Use Sentinel Graph to explore relationships between the relevant security entities

Correct answer: E

Option review:

A: Effective KQL hunting starts with the correct table because device, identity, email, cloud, and other event families are stored in different schemas. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: analyze relationships among security entities by using the Sentinel graph view.

B: KQL is the query language used to analyze large security datasets and supports filtering, aggregation, parsing, joins, and time-based correlation for threat hunting. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: analyze relationships among security entities by using the Sentinel graph view.

C: Hunting graphs help analysts reason about entity relationships and visualize how an attack may have spread across connected assets. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: analyze relationships among security entities by using the Sentinel graph view.

D: Sentinel hunting queries support repeatable proactive searches across the workspace and can be monitored as the analyst develops and refines the hunting hypothesis. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: analyze relationships among security entities by using the Sentinel graph view.

Learning point: Use Sentinel Graph to explore relationships between the relevant security entities

Question 21

Two teams at Proseware Services propose different approaches for the Tier 1 queue, response wave 11. The selection criterion is simple: the chosen approach must visualize connected entities and estimate the blast radius of the suspected attack. Which option should win the technical comparison if the SOC also wants to support repeatable response?

Select the Microsoft Defender XDR or Sentinel table whose schema contains the event type needed for the hunt
Use Microsoft Defender XDR threat analytics to understand the active threat, affected products, exposure, and recommended mitigations
Create and validate the Advanced Hunting query in Microsoft Defender XDR for the stated hunting hypothesis
Create or use the hunting graph to visualize connected entities and assess the incident blast radius
Create the Microsoft Sentinel hunting query and monitor its results for recurring or emerging suspicious activity

Correct answer: D

Option review:

C: Advanced Hunting provides cross-domain Defender data that can be queried with KQL to test hypotheses and investigate suspicious activity across supported entities. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: visualize connected entities and estimate the blast radius of the suspected attack.

E: Sentinel hunting queries support repeatable proactive searches across the workspace and can be monitored as the analyst develops and refines the hunting hypothesis. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: visualize connected entities and estimate the blast radius of the suspected attack.

Learning point: Create or use the hunting graph to visualize connected entities and assess the incident blast radius

Question 22

For the Tier 2 queue, response wave 11, Fourth Coffee wants the least indirect solution to this goal: analyze relationships among security entities by using the Sentinel graph view. Which action aligns most closely with that requirement and the need to separate collection from detection logic?

Create and validate the Advanced Hunting query in Microsoft Defender XDR for the stated hunting hypothesis
Use Sentinel Graph to explore relationships between the relevant security entities
Create or manage the Microsoft Sentinel Data Lake KQL job for the required large-scale or historical processing task
Use Microsoft Defender XDR threat analytics to understand the active threat, affected products, exposure, and recommended mitigations
Create the Microsoft Sentinel hunting query and monitor its results for recurring or emerging suspicious activity

Correct answer: B

Option review:

C: KQL jobs in the Sentinel Data Lake support scheduled or managed processing over data retained in the lake and are appropriate when the hunt depends on data-lake scale or history. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: analyze relationships among security entities by using the Sentinel graph view.

D: Threat analytics provides curated intelligence and organizational exposure context so analysts can understand relevant campaigns and prioritize mitigation. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: analyze relationships among security entities by using the Sentinel graph view.

Learning point: Use Sentinel Graph to explore relationships between the relevant security entities

Question 23

A modernization plan at Wingtip Toys includes a detection-engineering sprint. The security engineer is asked to choose the control that specifically helps the organization visualize connected entities and estimate the blast radius of the suspected attack. Which choice fits best for the endpoint-response team, response wave 12 while supporting the goal to separate collection from detection logic?

Create or use the hunting graph to visualize connected entities and assess the incident blast radius
Create the Microsoft Sentinel hunting query and monitor its results for recurring or emerging suspicious activity
Use Microsoft Defender XDR threat analytics to understand the active threat, affected products, exposure, and recommended mitigations
Write or refine the KQL query so it filters, correlates, summarizes, or joins the security data needed to expose the suspected threat pattern
Create or manage a Summary rule that materializes the required aggregated data into a summary table

Correct answer: A

Option review:

B: Sentinel hunting queries support repeatable proactive searches across the workspace and can be monitored as the analyst develops and refines the hunting hypothesis. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: visualize connected entities and estimate the blast radius of the suspected attack.

C: Threat analytics provides curated intelligence and organizational exposure context so analysts can understand relevant campaigns and prioritize mitigation. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: visualize connected entities and estimate the blast radius of the suspected attack.

Learning point: Create or use the hunting graph to visualize connected entities and assess the incident blast radius

Question 24

The cloud-security team, response wave 12 is moving into a controlled rollout at Fabrikam Retail. Which action should be included when the stated security objective is to analyze relationships among security entities by using the Sentinel graph view? The operational standard is to preserve investigation context.

Write or refine the KQL query so it filters, correlates, summarizes, or joins the security data needed to expose the suspected threat pattern
Create or use the hunting graph to visualize connected entities and assess the incident blast radius
Use Microsoft Defender XDR threat analytics to understand the active threat, affected products, exposure, and recommended mitigations
Use Sentinel Graph to explore relationships between the relevant security entities
Use a Microsoft Sentinel notebook and, when required, connect it to the Sentinel MCP Server for the advanced hunting workflow

Correct answer: D

Option review:

A: KQL is the query language used to analyze large security datasets and supports filtering, aggregation, parsing, joins, and time-based correlation for threat hunting. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: analyze relationships among security entities by using the Sentinel graph view.

B: Hunting graphs help analysts reason about entity relationships and visualize how an attack may have spread across connected assets. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: analyze relationships among security entities by using the Sentinel graph view.

E: Sentinel notebooks support programmable investigation and hunting workflows, including data science and AI-assisted integrations such as the Sentinel MCP Server. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: analyze relationships among security entities by using the Sentinel graph view.

Learning point: Use Sentinel Graph to explore relationships between the relevant security entities

Question 25

Tailspin Toys is replacing an ad hoc process during a data-ingestion rollout. The replacement must reliably visualize connected entities and estimate the blast radius of the suspected attack. Which security-operations approach should the Sentinel administrator implement for the night shift, response wave 13 if the team also wants to preserve investigation context?

Use Sentinel Graph to explore relationships between the relevant security entities
Create or manage a Summary rule that materializes the required aggregated data into a summary table
Create or manage the Microsoft Sentinel Data Lake KQL job for the required large-scale or historical processing task
Create the Microsoft Sentinel hunting query and monitor its results for recurring or emerging suspicious activity
Create or use the hunting graph to visualize connected entities and assess the incident blast radius

Correct answer: E

Option review:

B: Summary rules pre-aggregate selected data into tables that can improve query performance and make recurring analytical patterns easier to query. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: visualize connected entities and estimate the blast radius of the suspected attack.

C: KQL jobs in the Sentinel Data Lake support scheduled or managed processing over data retained in the lake and are appropriate when the hunt depends on data-lake scale or history. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: visualize connected entities and estimate the blast radius of the suspected attack.

E: Hunting graphs help analysts reason about entity relationships and visualize how an attack may have spread across connected assets. This directly addresses the requirement: visualize connected entities and estimate the blast radius of the suspected attack.

Learning point: Create or use the hunting graph to visualize connected entities and assess the incident blast radius

Question 26

An audit finding for the EMEA SOC, response wave 13 says the current process does not consistently analyze relationships among security entities by using the Sentinel graph view. Which Microsoft security action most directly closes that gap while helping the SOC minimize manual analyst steps?

Use Sentinel Graph to explore relationships between the relevant security entities
Create or manage a Summary rule that materializes the required aggregated data into a summary table
Create the Microsoft Sentinel hunting query and monitor its results for recurring or emerging suspicious activity
Write or refine the KQL query so it filters, correlates, summarizes, or joins the security data needed to expose the suspected threat pattern
Create or manage the Microsoft Sentinel Data Lake KQL job for the required large-scale or historical processing task

Correct answer: A

Option review:

D: KQL is the query language used to analyze large security datasets and supports filtering, aggregation, parsing, joins, and time-based correlation for threat hunting. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: analyze relationships among security entities by using the Sentinel graph view.

Learning point: Use Sentinel Graph to explore relationships between the relevant security entities

Question 27

The security operations analyst at Trey Research needs a repeatable configuration for the high-value-assets group, response wave 14. It must visualize connected entities and estimate the blast radius of the suspected attack. Which choice should be implemented instead of relying on manual incident work if the goal is to minimize manual analyst steps?

Create or use the hunting graph to visualize connected entities and assess the incident blast radius
Select the Microsoft Defender XDR or Sentinel table whose schema contains the event type needed for the hunt
Create the Microsoft Sentinel hunting query and monitor its results for recurring or emerging suspicious activity
Use Microsoft Defender XDR threat analytics to understand the active threat, affected products, exposure, and recommended mitigations
Create or manage the Microsoft Sentinel Data Lake KQL job for the required large-scale or historical processing task

Correct answer: A

Option review:

B: Effective KQL hunting starts with the correct table because device, identity, email, cloud, and other event families are stored in different schemas. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: visualize connected entities and estimate the blast radius of the suspected attack.

C: Sentinel hunting queries support repeatable proactive searches across the workspace and can be monitored as the analyst develops and refines the hunting hypothesis. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: visualize connected entities and estimate the blast radius of the suspected attack.

E: KQL jobs in the Sentinel Data Lake support scheduled or managed processing over data retained in the lake and are appropriate when the hunt depends on data-lake scale or history. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: visualize connected entities and estimate the blast radius of the suspected attack.

Learning point: Create or use the hunting graph to visualize connected entities and assess the incident blast radius

Question 28

During readiness testing at Lucerne Publishing, the privileged-users group, response wave 14 fails a business requirement because analysts cannot yet analyze relationships among security entities by using the Sentinel graph view. Which action should be implemented before rollout continues? The SOC also needs to retain evidence for follow-up analysis.

Use Microsoft Defender XDR threat analytics to understand the active threat, affected products, exposure, and recommended mitigations
Write or refine the KQL query so it filters, correlates, summarizes, or joins the security data needed to expose the suspected threat pattern
Use Sentinel Graph to explore relationships between the relevant security entities
Create or use the hunting graph to visualize connected entities and assess the incident blast radius
Create or manage the Microsoft Sentinel Data Lake KQL job for the required large-scale or historical processing task

Correct answer: C

Option review:

A: Threat analytics provides curated intelligence and organizational exposure context so analysts can understand relevant campaigns and prioritize mitigation. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: analyze relationships among security entities by using the Sentinel graph view.

B: KQL is the query language used to analyze large security datasets and supports filtering, aggregation, parsing, joins, and time-based correlation for threat hunting. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: analyze relationships among security entities by using the Sentinel graph view.

Learning point: Use Sentinel Graph to explore relationships between the relevant security entities

Question 29

A governance review asks the incident responder to justify the control selected for the remote-user fleet, response wave 15. The requirement is to visualize connected entities and estimate the blast radius of the suspected attack. Which action has the clearest technical alignment while supporting the goal to retain evidence for follow-up analysis?

Create or use the hunting graph to visualize connected entities and assess the incident blast radius
Create and validate the Advanced Hunting query in Microsoft Defender XDR for the stated hunting hypothesis
Create or manage the Microsoft Sentinel Data Lake KQL job for the required large-scale or historical processing task
Create or manage a Summary rule that materializes the required aggregated data into a summary table
Create the Microsoft Sentinel hunting query and monitor its results for recurring or emerging suspicious activity

Correct answer: A

Option review:

B: Advanced Hunting provides cross-domain Defender data that can be queried with KQL to test hypotheses and investigate suspicious activity across supported entities. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: visualize connected entities and estimate the blast radius of the suspected attack.

C: KQL jobs in the Sentinel Data Lake support scheduled or managed processing over data retained in the lake and are appropriate when the hunt depends on data-lake scale or history. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: visualize connected entities and estimate the blast radius of the suspected attack.

D: Summary rules pre-aggregate selected data into tables that can improve query performance and make recurring analytical patterns easier to query. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: visualize connected entities and estimate the blast radius of the suspected attack.

E: Sentinel hunting queries support repeatable proactive searches across the workspace and can be monitored as the analyst develops and refines the hunting hypothesis. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: visualize connected entities and estimate the blast radius of the suspected attack.

Learning point: Create or use the hunting graph to visualize connected entities and assess the incident blast radius

Question 30

For a multi-cloud monitoring rollout, Woodgrove Bank needs a Microsoft security capability with this effect: Sentinel Graph exposes entity relationships so analysts can pivot through connections that are difficult to understand from isolated log rows. Which option most accurately provides that capability for the production subscription, response wave 15? The process should avoid unnecessary alert noise.

Write or refine the KQL query so it filters, correlates, summarizes, or joins the security data needed to expose the suspected threat pattern
Use a Microsoft Sentinel notebook and, when required, connect it to the Sentinel MCP Server for the advanced hunting workflow
Select the Microsoft Defender XDR or Sentinel table whose schema contains the event type needed for the hunt
Create and validate the Advanced Hunting query in Microsoft Defender XDR for the stated hunting hypothesis
Use Sentinel Graph to explore relationships between the relevant security entities

Correct answer: E

Option review:

A: KQL is the query language used to analyze large security datasets and supports filtering, aggregation, parsing, joins, and time-based correlation for threat hunting. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: analyze relationships among security entities by using the Sentinel graph view.

B: Sentinel notebooks support programmable investigation and hunting workflows, including data science and AI-assisted integrations such as the Sentinel MCP Server. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: analyze relationships among security entities by using the Sentinel graph view.

C: Effective KQL hunting starts with the correct table because device, identity, email, cloud, and other event families are stored in different schemas. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: analyze relationships among security entities by using the Sentinel graph view.

Learning point: Use Sentinel Graph to explore relationships between the relevant security entities

Question 1

Question 2

Question 3

Question 4

Question 5

Question 6

Question 7

Question 8

Question 9

Question 10

Question 11

Question 12

Question 13

Question 14

Question 15

Question 16

Question 17

Question 18

Question 19

Question 20

Question 21

Question 22

Question 23

Question 24

Question 25

Question 26

Question 27

Question 28

Question 29

Question 30

Related posts: