Exam Bundle

A severity-trend dashboard can report incidents without exposing entities, but closing a case may still leave its source-event logs intact. That retention property must be tested by querying the raw records after case closure.

“A scheduled hunting query can access the planned recent event window.” tests The SOC wants threat-detection logs queried frequently with low latency. It does not demonstrate the target outcome of Closing or modifying a test incident does not delete the raw security events. in the case described. This scenario concerns: An analyst thinks deleting an incident removes the underlying raw evidence.

“The authorized analyst opens the workbook and an unapproved account is denied.” may be appropriate evidence for A dashboard owner wants to restrict access to sensitive incident visualizations., but the verification of the current incident must instead show Closing or modifying a test incident does not delete the raw security events. This scenario concerns: An analyst thinks deleting an incident removes the underlying raw evidence.

Keeping detection logs in the analytics tier supports frequent interactive searches, but does not perform periodic reduction of retained source events into a summarized analytics table.

This alternative, “Plan analytics-tier and long-term retention separately to satisfy both workloads.”, is appropriate for A team wants 30-day immediate queries while also retaining a longer historical trail. It does not establish the required outcome of A daily aggregate table contains the expected per-source counts for a known sample. This scenario concerns: A SOC wants long-term visibility into summarized firewall metrics while limiting hot storage.

The proposed action “Test the saved workbook's KQL queries and inspect errors or missing fields.” solves An engineering team needs to monitor workbook query health after changing a data source. The present requirement is different: A SOC wants long-term visibility into summarized firewall metrics while limiting hot storage.

“A scheduled hunting query can access the planned recent event window.” tests The SOC wants threat-detection logs queried frequently with low latency. It does not demonstrate the target outcome of A daily aggregate table contains the expected per-source counts for a known sample. in the case described. This scenario concerns: A SOC wants long-term visibility into summarized firewall metrics while limiting hot storage.

This proposed result, “The workbook displays the expected owner counts for sample incidents.”, relates to Security leadership wants a weekly workbook chart of high-priority incidents by owner. It would not prove that Consider supported summary aggregation from retained source logs into an analytics summary table. met the current requirement. This scenario concerns: A SOC wants long-term visibility into summarized firewall metrics while limiting hot storage.

“Every critical visual returns nonempty results with the revised schema.” may be appropriate evidence for An engineering team needs to monitor workbook query health after changing a data source., but the verification of the current incident must instead show A daily aggregate table contains the expected per-source counts for a known sample. This scenario concerns: A SOC wants long-term visibility into summarized firewall metrics while limiting hot storage.

“Create a Microsoft Sentinel workbook that queries the incident dataset and groups by owner.” would prioritize Security leadership wants a weekly workbook chart of high-priority incidents by owner. That does not directly address the stated issue: An engineering team needs to monitor workbook query health after changing a data source.

Correcting the workbook's workspace reference helps when the dashboard points at the wrong data source. The problem here is failing saved KQL after a schema change; inspect each query's errors and missing fields before changing workspace routing.

The proposed action “Evaluate the Sentinel data-lake or cost-appropriate retention tier against investigation needs.” solves A team has low-fidelity historical logs that rarely require full analytics queries. The present requirement is different: An engineering team needs to monitor workbook query health after changing a data source.

This proposed result, “Analysts see comparable rule-count trends over the selected windows.”, relates to An operations dashboard needs to compare rule volume before and after tuning. It would not prove that Test the saved workbook's KQL queries and inspect errors or missing fields. met the current requirement. This scenario concerns: An engineering team needs to monitor workbook query health after changing a data source.

Engineer-versus-billing role tests establish an RBAC boundary. They do not prove every workbook visual returns valid results using the revised table schema.

A known pilot incident appearing in the correct workbook source proves one query connects. Other critical visuals can still break on renamed columns, so all saved KQL visuals must be tested.

The proposed action “Test the saved workbook's KQL queries and inspect errors or missing fields.” solves An engineering team needs to monitor workbook query health after changing a data source. The present requirement is different: A Sentinel platform administrator must find which roles are missing for an analyst to run investigations.

The option “Review Sentinel workspace data usage and cost analysis by table.” would address The SOC needs to know which tables drive most Sentinel ingestion cost. It is less direct than Examine Azure RBAC role assignments at workspace and resource-group scope. for the case at hand. This scenario concerns: A Sentinel platform administrator must find which roles are missing for an analyst to run investigations.

Granting a Sentinel responder role authorizes case updates, but it does not diagnose an unexpected effective permission. Inspect workspace and resource-group role assignments to find the inheritance or overly broad grant.

“Recent searches are responsive and older events remain accessible by the supported archival method.” may be appropriate evidence for A team wants 30-day immediate queries while also retaining a longer historical trail., but the verification of the current incident must instead show The analyst's intended actions succeed under the corrected least-privilege assignment. This scenario concerns: A Sentinel platform administrator must find which roles are missing for an analyst to run investigations.

A read-only test proves the analyst lacks connector-edit rights. The current role repair also requires positively testing the analyst's intended permitted operations after the least-privilege assignment is corrected.

“A usage report identifies the principal ingesting tables and quantities.” tests The SOC needs to know which tables drive most Sentinel ingestion cost. It does not demonstrate the target outcome of The analyst's intended actions succeed under the corrected least-privilege assignment. in the case described. This scenario concerns: A Sentinel platform administrator must find which roles are missing for an analyst to run investigations.

The proposed action “Consider supported summary aggregation from retained source logs into an analytics summary table.” solves A SOC wants long-term visibility into summarized firewall metrics while limiting hot storage. The present requirement is different: A team wants 30-day immediate queries while also retaining a longer historical trail.

Granting Logic Apps/Sentinel automation roles addresses playbook creation. It does not establish separate data retention paths for low-latency analytics and older historical investigations.

“Evaluate the Sentinel data-lake or cost-appropriate retention tier against investigation needs.” would prioritize A team has low-fidelity historical logs that rarely require full analytics queries. That does not directly address the stated issue: A team wants 30-day immediate queries while also retaining a longer historical trail.

Opening a workbook and incidents in the target portal validates interface authorization. It does not show recent queries are responsive while older records remain retrievable through the appropriate archival method.

One successful historical query proves that preserved old records can be read. It does not also verify the planned low-latency recent search workload, which must be checked separately.

“Stored records remain retrievable under the approved historical search workflow.” tests A team has low-fidelity historical logs that rarely require full analytics queries. It does not demonstrate the target outcome of Recent searches are responsive and older events remain accessible by the supported archival method. in the case described. This scenario concerns: A team wants 30-day immediate queries while also retaining a longer historical trail.

The option “Explain and verify the separation between incident records and their source log tables.” would address An analyst thinks deleting an incident removes the underlying raw evidence. It is less direct than Aggregate incident metrics in a workbook with appropriate permission scoping. for the case at hand. This scenario concerns: An executive workbook should use filtered incident severity without exposing raw sensitive entities.

“Use scoped workspace or workbook resource access permissions for approved viewers.” would prioritize A dashboard owner wants to restrict access to sensitive incident visualizations. That does not directly address the stated issue: An executive workbook should use filtered incident severity without exposing raw sensitive entities.

This alternative, “Grant the supported Sentinel responder role at the appropriate scope.”, is appropriate for A responder needs to update Sentinel incidents while other users should remain read-only. It does not establish the required outcome of The dashboard shows severity trends without revealing unauthorized entity details. This scenario concerns: An executive workbook should use filtered incident severity without exposing raw sensitive entities.

A daily per-source aggregate table verifies summarization of event counts. It does not establish that the severity-trend dashboard hides unauthorized entity details while showing the intended incident patterns.

“The authorized analyst opens the workbook and an unapproved account is denied.” tests A dashboard owner wants to restrict access to sensitive incident visualizations. It does not demonstrate the target outcome of The dashboard shows severity trends without revealing unauthorized entity details. in the case described. This scenario concerns: An executive workbook should use filtered incident severity without exposing raw sensitive entities.

“Closing or modifying a test incident does not delete the raw security events.” may be appropriate evidence for An analyst thinks deleting an incident removes the underlying raw evidence., but the verification of the current incident must instead show The dashboard shows severity trends without revealing unauthorized entity details. This scenario concerns: An executive workbook should use filtered incident severity without exposing raw sensitive entities.