SC-200 Certification Practice Question #221

Question

You have a Microsoft 365 subscription that uses Microsoft Defender XDR.

You are investigating an attacker that is known to use the Microsoft Graph API as an attack vector. The attacker performs the tactics shown the following table.

You need to search for malicious activities in your organization.

Which tactics can you analyze by using the MicrosoftGraphActivityLogs table?

Accepted Answer

MicrosoftGraphActivityLogs records HTTP requests made to the Microsoft Graph API. Tactic1 (discover misconfigured mailboxes) and Tactic2 (search/export Teams chats) are clearly Graph API operations and are captured by this table. Tactic3 (deleting Azure VMs) is fundamentally an Azure Resource Manager action recorded in AzureActivity, not the Graph activity log — so on pure technical merit the precise answer is Tactic1 + Tactic2, which the community (user636, g_man_rap, 90158a0) repeatedly notes. However, the exam offers no "Tactic1 and Tactic2 only" option, and the stem stipulates the attacker used the Microsoft Graph API as the attack vector for the listed tactics; under that framing the intended/Suggested Answer and the Most Voted answer are both E. Because the official answer and the literal documentation pull in different directions (the question is acknowledged as poorly constructed), confidence is lowered to 76: E is the answer to mark on the exam, but the only technically Graph-logged tactics are 1 and 2.

More SC-200 practice questions