Exam Bundle

Classifying a sanctioned scheduled job versus credential misuse addresses one access pattern. The current cloud activity requires checking whether bulk access is normal business use or actually exfiltration of data.

“The investigation establishes whether the observed account-to-host path is suspicious.” tests A Defender for Identity alert suggests lateral movement using remote sessions. It does not demonstrate the target outcome of The investigation distinguishes expected bulk access from suspicious exfiltration behavior. in the case described. This scenario concerns: An insider-risk alert points to bulk downloads of sensitive SharePoint files.

This proposed result, “The incident record correlates the email delivery with the endpoint process execution.”, relates to The SOC receives a Defender XDR incident with alerts from email and endpoint products. It would not prove that Investigate the associated Microsoft Purview alert and correlate authorized user/file activities. met the current requirement. This scenario concerns: An insider-risk alert points to bulk downloads of sensitive SharePoint files.

Cloud Apps anomaly/session analysis is one source of SaaS risk telemetry. The proposed remediation also requires reviewing the actual sensitive-data event and corresponding identity signals, not assuming every app anomaly is a confirmed leak.

This alternative, “Evaluate individual alert evidence and preserve the valid incident rather than closing everything as benign.”, is appropriate for A Defender XDR incident includes one false-positive alert alongside genuine malware detections. It does not establish the required outcome of The incident identifies the affected files, destination and approved next action. This scenario concerns: A user account appears in a Purview DLP incident involving unusual external sharing.

The proposed action “Validate process, URL, account and temporal context before containment.” solves An incident's external IP belongs to a shared cloud service and is not sufficient proof of compromise. The present requirement is different: A user account appears in a Purview DLP incident involving unusual external sharing.

“The workflow records a required approval before performing the revocation.” tests An agentic AI incident workflow proposes revoking an account without approval. It does not demonstrate the target outcome of The incident identifies the affected files, destination and approved next action. in the case described. This scenario concerns: A user account appears in a Purview DLP incident involving unusual external sharing.

This proposed result, “The affected application, user and downloaded objects are identified.”, relates to A SaaS app is showing impossible download volume for a user account. It would not prove that Review the sensitive-data event context and linked identity signals before remediation. met the current requirement. This scenario concerns: A user account appears in a Purview DLP incident involving unusual external sharing.

A suspicious account-to-host path helps assess lateral movement. This case requires identifying the actual files and transfer destination with a response decision, which path analysis alone cannot supply.

This alternative, “Inspect correlation and entity evidence before creating a second case.”, is appropriate for A high-severity Defender XDR incident has duplicate alerts from two workload sensors. It does not establish the required outcome of The attack path and affected VM activity are recorded in the security incident. This scenario concerns: An Azure virtual machine has an active high-severity Defender for Cloud alert.

The proposed action “Correlate the cloud resource alert with identity and endpoint events in Defender XDR.” solves A server with Defender for Cloud protection shows possible credential theft. The present requirement is different: An Azure virtual machine has an active high-severity Defender for Cloud alert.

The option “Start from the unified incident evidence and reconstruct the attack sequence across entities.” would address The SOC receives a Defender XDR incident with alerts from email and endpoint products. It is less direct than Investigate the Defender for Cloud workload-protection alert and relevant resource context. for the case at hand. This scenario concerns: An Azure virtual machine has an active high-severity Defender for Cloud alert.

This proposed result, “The analyst retains one coherent incident where alerts share the same attack sequence.”, relates to A high-severity Defender XDR incident has duplicate alerts from two workload sensors. It would not prove that Investigate the Defender for Cloud workload-protection alert and relevant resource context. met the current requirement. This scenario concerns: An Azure virtual machine has an active high-severity Defender for Cloud alert.

“The investigation ties the destination IP to a specific process and VM.” may be appropriate evidence for A Defender for Cloud alert indicates a new outbound command-and-control connection from a VM., but the verification of the current incident must instead show The attack path and affected VM activity are recorded in the security incident. This scenario concerns: An Azure virtual machine has an active high-severity Defender for Cloud alert.

Documenting the resource, cloud alert and approved containment records the response decision. It does not reconstruct the affected VM's execution and attack path in the case evidence.

The proposed action “Reconstruct a multi-stage, multi-domain incident timeline from email, device and cloud evidence.” solves A campaign spreads from phishing to endpoint command execution and cloud file access. The present requirement is different: A container workload reports suspicious process execution in a protected cluster.

The option “Investigate Entra authentication details and risk signals for possible MFA fatigue.” would address A user reports an unexpected MFA prompt immediately before a suspicious login. It is less direct than Pivot from Defender for Cloud alert to associated workload and runtime evidence. for the case at hand. This scenario concerns: A container workload reports suspicious process execution in a protected cluster.

Defender for Cloud Apps permissions and SaaS detections address cloud-application usage. The cited alert is from Defender for Cloud, so pivot to workload/runtime evidence on the affected cloud resource.

“The case records push attempts, sign-in result and source information.” may be appropriate evidence for A user reports an unexpected MFA prompt immediately before a suspicious login., but the verification of the current incident must instead show The analyst documents the container, image, node and triggering process. This scenario concerns: A container workload reports suspicious process execution in a protected cluster.

Avoiding blanket cloud-IP blocking can be justified by scope analysis. It does not identify the actual container, image, node and process responsible for the cloud workload alert.

“The investigation documents both devices and their correlated connections.” tests Two devices communicate through the same suspicious external infrastructure. It does not demonstrate the target outcome of The analyst documents the container, image, node and triggering process. in the case described. This scenario concerns: A container workload reports suspicious process execution in a protected cluster.

The proposed action “Investigate the Defender for Cloud workload-protection alert and relevant resource context.” solves An Azure virtual machine has an active high-severity Defender for Cloud alert. The present requirement is different: A server with Defender for Cloud protection shows possible credential theft.

Joining Entra audit, email and endpoint records can reconstruct an account incident. The present alert begins with a cloud resource, so the investigation also needs that resource's runtime context correlated to identity and endpoint evidence.

“Correlate its resource alert with host process and network connection evidence.” would prioritize A Defender for Cloud alert indicates a new outbound command-and-control connection from a VM. That does not directly address the stated issue: A server with Defender for Cloud protection shows possible credential theft.

Attributing a destination IP to one VM process is network/endpoint analysis. It does not establish the broader set of matching sign-ins and process traces needed to order the cross-domain incident timeline.

“The evidence supports a targeted response rather than blanket cloud-IP blocking.” tests An incident's external IP belongs to a shared cloud service and is not sufficient proof of compromise. It does not demonstrate the target outcome of Matching sign-ins or process traces establish the incident timeline. in the case described. This scenario concerns: A server with Defender for Cloud protection shows possible credential theft.

This proposed result, “The event sequence identifies target service accounts and request sources.”, relates to A Defender for Identity alert flags a possible Kerberoasting pattern. It would not prove that Correlate the cloud resource alert with identity and endpoint events in Defender XDR. met the current requirement. This scenario concerns: A server with Defender for Cloud protection shows possible credential theft.

The option “Correlate its resource alert with host process and network connection evidence.” would address A Defender for Cloud alert indicates a new outbound command-and-control connection from a VM. It is less direct than Validate the cloud alert's exposure and attack evidence before changing access. for the case at hand. This scenario concerns: A publicly exposed storage service appears in a high-priority threat finding.

Cloud Apps file-transfer evidence traces SaaS activity from a user/device. The task is verifying Defender for Cloud resource exposure and attack indicators before altering the affected cloud resource's access.

“Investigate the Defender for Cloud workload-protection alert and relevant resource context.” would prioritize An Azure virtual machine has an active high-severity Defender for Cloud alert. That does not directly address the stated issue: A publicly exposed storage service appears in a high-priority threat finding.

Identifying transferred files, their destination and next action concerns a data-exfiltration investigation. It does not record the exact cloud resource, alert and approved containment action for this workload.

“The attack path and affected VM activity are recorded in the security incident.” tests An Azure virtual machine has an active high-severity Defender for Cloud alert. It does not demonstrate the target outcome of The response captures the affected resource, alert and authorized containment action. in the case described. This scenario concerns: A publicly exposed storage service appears in a high-priority threat finding.

“The case history identifies who made each change and the reason.” may be appropriate evidence for Several responders are changing incident status without a recorded reason., but the verification of the current incident must instead show The response captures the affected resource, alert and authorized containment action. This scenario concerns: A publicly exposed storage service appears in a high-priority threat finding.