Exam Bundle

A case-change history explains which analyst edited a case, not which recipients clicked a malicious link. Use message/URL interaction telemetry to identify clicked users and required follow-up response.

This proposed result, “The case shows distinct campaigns connected by the same file artifact.”, relates to The same malicious attachment is observed across multiple email campaigns. It would not prove that Examine URL click telemetry and message investigation in Defender for Office 365. met the current requirement. This scenario concerns: Several malicious URLs were rewritten by Safe Links but users still clicked.

“The reopened case contains the new alert evidence and updated disposition.” may be appropriate evidence for A Sentinel incident was closed as benign but new evidence suggests malicious activity., but the verification of the current incident must instead show A report identifies which users clicked and what follow-up response is needed. This scenario concerns: Several malicious URLs were rewritten by Safe Links but users still clicked.

A multi-domain timeline can combine endpoint, email and cloud events into an attack chain. The immediate task is identifying the phishing sender infrastructure and affected recipients across the campaign evidence.

This alternative, “Pivot from the Sentinel alert entity into queryable logs and threat intelligence.”, is appropriate for An alert contains an external IP but little context about related activity. It does not establish the required outcome of The final incident timeline links related senders and affected mailboxes. This scenario concerns: A suspected phishing campaign includes multiple lookalike sender domains.

The proposed action “Use Microsoft Defender for Office 365 investigation and response to trace the message and remediate matching copies.” solves A user clicked a phishing link and multiple coworkers received the same message. The present requirement is different: A suspected phishing campaign includes multiple lookalike sender domains.

“The timeline orders initial access, execution and data access with matching entity identifiers.” tests A campaign spreads from phishing to endpoint command execution and cloud file access. It does not demonstrate the target outcome of The final incident timeline links related senders and affected mailboxes. in the case described. This scenario concerns: A suspected phishing campaign includes multiple lookalike sender domains.

“The campaign investigation lists affected recipients and records completed message remediation.” may be appropriate evidence for A user clicked a phishing link and multiple coworkers received the same message., but the verification of the current incident must instead show The final incident timeline links related senders and affected mailboxes. This scenario concerns: A suspected phishing campaign includes multiple lookalike sender domains.

Invalidating compromised user sessions and confirming token rejection proves identity containment. It does not show the email incident timeline links the related senders and mailboxes targeted by the campaign.

“Review Defender for Office 365 campaign and message investigation evidence before adding a narrow block.” would prioritize A deceptive sender passed basic spam checks and delivered credential-harvesting email. That does not directly address the stated issue: A malware message was delivered, then later identified and removed automatically.

This alternative, “Correlate Entra audit logs, Defender for Office evidence and device process history into one case.”, is appropriate for A multistage intrusion combines identity compromise, suspicious mail rules and endpoint persistence. It does not establish the required outcome of The removal status and affected message set can be verified in the investigation. This scenario concerns: A malware message was delivered, then later identified and removed automatically.

The option “Locate matching email artifacts with Defender for Office 365 and apply authorized remediation.” would address An inbox contains emails with an attachment hash now classified as malware. It is less direct than Review automated Defender for Office 365 remediation and its Action center audit trail. for the case at hand. This scenario concerns: A malware message was delivered, then later identified and removed automatically.

“The campaign investigation lists affected recipients and records completed message remediation.” may be appropriate evidence for A user clicked a phishing link and multiple coworkers received the same message., but the verification of the current incident must instead show The removal status and affected message set can be verified in the investigation. This scenario concerns: A malware message was delivered, then later identified and removed automatically.

App registration and consent evidence tracks cloud application access. It does not verify that the malicious email copies were removed from every identified mailbox.

Correlating two devices and their connections documents attack spread. The required message-removal test needs the affected mailbox set and verified removal state, not endpoint connection analysis.

This alternative, “Inspect correlation and entity evidence before creating a second case.”, is appropriate for A high-severity Defender XDR incident has duplicate alerts from two workload sensors. It does not establish the required outcome of The incident record correlates the email delivery with the endpoint process execution. This scenario concerns: The SOC receives a Defender XDR incident with alerts from email and endpoint products.

The proposed action “Evaluate individual alert evidence and preserve the valid incident rather than closing everything as benign.” solves A Defender XDR incident includes one false-positive alert alongside genuine malware detections. The present requirement is different: The SOC receives a Defender XDR incident with alerts from email and endpoint products.

Attack-disruption rationale identifies why containment occurred and which entity was affected. It does not by itself reconstruct the ordered alert and entity evidence linking all stages of the unified incident.

Distinguishing false positives from malicious alerts is a disposition decision. It does not establish that the original email delivery caused or preceded the observed endpoint process execution.

Expected bulk access versus exfiltration analysis compares user data-transfer patterns. It does not link the phishing email to the malware process on the endpoint; correlate message delivery, process tree and timestamps.

“The analyst retains one coherent incident where alerts share the same attack sequence.” tests A high-severity Defender XDR incident has duplicate alerts from two workload sensors. It does not demonstrate the target outcome of The incident record correlates the email delivery with the endpoint process execution. in the case described. This scenario concerns: The SOC receives a Defender XDR incident with alerts from email and endpoint products.

The proposed action “Correlate Defender for Identity reconnaissance alerts with related Entra and endpoint events.” solves The SOC finds repeated domain reconnaissance activity preceding a password-spray attack. The present requirement is different: An endpoint threat triggers cross-domain automatic attack disruption.

The option “Investigate Cloud Apps activity and endpoint transfer evidence for the same device and user.” would address A defender-managed application is suspected of exfiltrating files to an unsanctioned SaaS service. It is less direct than Verify the disruption rationale and entity containment in the unified Defender XDR incident. for the case at hand. This scenario concerns: An endpoint threat triggers cross-domain automatic attack disruption.

“Start from the unified incident evidence and reconstruct the attack sequence across entities.” would prioritize The SOC receives a Defender XDR incident with alerts from email and endpoint products. That does not directly address the stated issue: An endpoint threat triggers cross-domain automatic attack disruption.

Correlating email arrival with process execution identifies an attack step. It does not document which compromised devices or identities were subsequently contained and the justification for each action.

“A unified timeline shows the reconnaissance followed by authentication attempts.” tests The SOC finds repeated domain reconnaissance activity preceding a password-spray attack. It does not demonstrate the target outcome of The incident history documents which compromised assets were contained and why. in the case described. This scenario concerns: An endpoint threat triggers cross-domain automatic attack disruption.

This proposed result, “The audit links the remediation to its rule, approver state and affected asset.”, relates to A closed incident is discovered to have unapproved automated remediation. It would not prove that Verify the disruption rationale and entity containment in the unified Defender XDR incident. met the current requirement. This scenario concerns: An endpoint threat triggers cross-domain automatic attack disruption.

The option “Inspect the identity alert and associated domain-controller evidence for abnormal service-ticket requests.” would address A Defender for Identity alert flags a possible Kerberoasting pattern. It is less direct than Investigate the associated Microsoft Purview alert and correlate authorized user/file activities. for the case at hand. This scenario concerns: An insider-risk alert points to bulk downloads of sensitive SharePoint files.

“Correlate its resource alert with host process and network connection evidence.” would prioritize A Defender for Cloud alert indicates a new outbound command-and-control connection from a VM. That does not directly address the stated issue: An insider-risk alert points to bulk downloads of sensitive SharePoint files.

This alternative, “Investigate the Defender for Cloud workload-protection alert and relevant resource context.”, is appropriate for An Azure virtual machine has an active high-severity Defender for Cloud alert. It does not establish the required outcome of The investigation distinguishes expected bulk access from suspicious exfiltration behavior. This scenario concerns: An insider-risk alert points to bulk downloads of sensitive SharePoint files.

Classifying a sanctioned scheduled job versus credential misuse addresses one access pattern. The current cloud activity requires checking whether bulk access is normal business use or actually exfiltration of data.

“The investigation establishes whether the observed account-to-host path is suspicious.” tests A Defender for Identity alert suggests lateral movement using remote sessions. It does not demonstrate the target outcome of The investigation distinguishes expected bulk access from suspicious exfiltration behavior. in the case described. This scenario concerns: An insider-risk alert points to bulk downloads of sensitive SharePoint files.

This proposed result, “The incident record correlates the email delivery with the endpoint process execution.”, relates to The SOC receives a Defender XDR incident with alerts from email and endpoint products. It would not prove that Investigate the associated Microsoft Purview alert and correlate authorized user/file activities. met the current requirement. This scenario concerns: An insider-risk alert points to bulk downloads of sensitive SharePoint files.