Analyzing Microsoft Graph API attack tactics through the MicrosoftGraphActivityLogs advanced-hunting table

SC-200 By islever Editorial Last updated

Investigate Microsoft 365 activities to identify threats

Short answer

D The MicrosoftGraphActivityLogs table records all Microsoft Graph API activity, so all listed tactics are analyzable there.

Question

You have a Microsoft 365 subscription that uses Microsoft Defender XDR. You are investigating an attacker that is known to use the Microsoft Graph API as an attack vector. The attacker performs the tactics shown the following table. You need to search for malicious activities in your organization. Which tactics can you analyze by using the MicrosoftGraphActivityLogs table? - Exhibit: Analyzing Microsoft Graph API attack tactics through the
  1. Tactic2 only
  2. Tactic1 and Tactic2 only
  3. Tactic2 and Tactic3 only
  4. Tactic1, Tactic2, and Tactic3 Correct Answer

Key Takeaways

The MicrosoftGraphActivityLogs table in advanced hunting captures Microsoft Graph API activity across the tenant, making it the single source to investigate any tactic expressed through Graph API calls.

When an attacker uses the Microsoft Graph API as a vector, all Graph API call activity is recorded in the MicrosoftGraphActivityLogs table, so every tactic that manifests as Graph calls can be analyzed there.

Common mistake: Assuming only one tactic is visible — because the table logs all Graph API activity, any tactic carried out via Graph calls (not just one) is analyzable there.

Expert Analysis

Why the Answer Is Correct

Microsoft Defender XDR advanced hunting provides the MicrosoftGraphActivityLogs table, which records Microsoft Graph API activity in the tenant. Any attacker tactic executed through the Graph API is captured there, so all listed tactics that are expressed as Graph calls can be analyzed using this table.

Why the Other Options Are Wrong

Selecting only Tactic2 (A) or subsets (B, C) undercounts the coverage; the table logs all Graph API activity, so all tactics performed via Graph are analyzable, not just one or two.

Community Comment Notes

The community favors D (all three, 100 votes). Avaris and Vokuhila note all three can be analyzed via the table, confirming the comprehensive coverage of MicrosoftGraphActivityLogs.

Official Reference

https://learn.microsoft.com/en-us/graph/microsoft-graph-activity-logs-overview

This link opens the official vendor documentation in a new tab.

Community Votes

D
100%

100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 4 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 4

  1. Avaris 👍 5 Answered D
    all 3 can be used checked it with copilot
  2. Vokuhila 👍 4 Answered D
    all 3 can be used
  3. laddu001 👍 3
    actic1, Tactic2, and Tactic3
  4. smanzana 👍 1
    C is correct

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Creating a Microsoft Sentinel bookmark from the Hunting page to support an incident investigation

S-grade

Identifying Affected Entities in Microsoft Defender XDR Incidents

S-grade

Containing a Defender for Identity pass-the-ticket alert by quarantining only the affected device

S-grade

Limiting Microsoft Defender device discovery to specific onboarded devices by creating a device tag first

S-grade

Practice All SC-200 Questions

Access 80 questions with complete answers and detailed explanations.

View Full SC-200 Practice Test →

← Back to SC-200 Study Guide