Exam Bundle

Identifying transferred files, their destination and next action concerns a data-exfiltration investigation. It does not record the exact cloud resource, alert and approved containment action for this workload.

“The attack path and affected VM activity are recorded in the security incident.” tests An Azure virtual machine has an active high-severity Defender for Cloud alert. It does not demonstrate the target outcome of The response captures the affected resource, alert and authorized containment action. in the case described. This scenario concerns: A publicly exposed storage service appears in a high-priority threat finding.

“The case history identifies who made each change and the reason.” may be appropriate evidence for Several responders are changing incident status without a recorded reason., but the verification of the current incident must instead show The response captures the affected resource, alert and authorized containment action. This scenario concerns: A publicly exposed storage service appears in a high-priority threat finding.

“Investigate Cloud Apps activity and endpoint transfer evidence for the same device and user.” would prioritize A defender-managed application is suspected of exfiltrating files to an unsanctioned SaaS service. That does not directly address the stated issue: A SaaS app is showing impossible download volume for a user account.

This alternative, “Locate matching email artifacts with Defender for Office 365 and apply authorized remediation.”, is appropriate for An inbox contains emails with an attachment hash now classified as malware. It does not establish the required outcome of The affected application, user and downloaded objects are identified. This scenario concerns: A SaaS app is showing impossible download volume for a user account.

The proposed action “Correlate Cloud Apps anomalous activity with Entra sign-in evidence.” solves A third-party SaaS account shows repeated risky sign-ins from unfamiliar countries. The present requirement is different: A SaaS app is showing impossible download volume for a user account.

“The user-risk history and chosen reset or risk-dismissal outcome are documented.” tests An Entra ID user is flagged as at risk following a credential leak. It does not demonstrate the target outcome of The affected application, user and downloaded objects are identified. in the case described. This scenario concerns: A SaaS app is showing impossible download volume for a user account.

This proposed result, “The incident identifies the affected files, destination and approved next action.”, relates to A user account appears in a Purview DLP incident involving unusual external sharing. It would not prove that Investigate the Microsoft Defender for Cloud Apps anomaly and session evidence. met the current requirement. This scenario concerns: A SaaS app is showing impossible download volume for a user account.

Case edit history establishes who changed investigation notes. It cannot name the affected cloud application, the user who accessed it and the objects downloaded; those come from app/file activity events.

“Investigate app permissions and related Defender for Cloud Apps detections.” would prioritize A suspicious OAuth application requested excessive consent permissions. That does not directly address the stated issue: A sanctioned cloud application suddenly starts sharing files outside policy.

This alternative, “Investigate Cloud Apps activity and endpoint transfer evidence for the same device and user.”, is appropriate for A defender-managed application is suspected of exfiltrating files to an unsanctioned SaaS service. It does not establish the required outcome of The analyst identifies policy-matching files and the external recipients. This scenario concerns: A sanctioned cloud application suddenly starts sharing files outside policy.

The option “Review Defender for Office 365 campaign and message investigation evidence before adding a narrow block.” would address A deceptive sender passed basic spam checks and delivered credential-harvesting email. It is less direct than Review Defender for Cloud Apps activity logs and file policy alerts. for the case at hand. This scenario concerns: A sanctioned cloud application suddenly starts sharing files outside policy.

This proposed result, “The incident identifies the affected files, destination and approved next action.”, relates to A user account appears in a Purview DLP incident involving unusual external sharing. It would not prove that Review Defender for Cloud Apps activity logs and file policy alerts. met the current requirement. This scenario concerns: A sanctioned cloud application suddenly starts sharing files outside policy.

“The case priority reflects asset criticality and supporting attack evidence.” may be appropriate evidence for The SOC wants to prioritize alerts from a sensitive executive identity during an active attack., but the verification of the current incident must instead show The analyst identifies policy-matching files and the external recipients. This scenario concerns: A sanctioned cloud application suddenly starts sharing files outside policy.

Showing destination SaaS and originating device establishes transfer routing. The required test must also identify the specific files matching the policy and the external recipients exposed.

This alternative, “Investigate the Sentinel incident's alert list, entities and related events.”, is appropriate for Multiple Sentinel alerts represent stages of one intrusion and should be triaged together. It does not establish the required outcome of The investigation lists granted scopes, consent actors and affected users. This scenario concerns: A suspicious OAuth application requested excessive consent permissions.

The option “Investigate Cloud Apps activity and endpoint transfer evidence for the same device and user.” would address A defender-managed application is suspected of exfiltrating files to an unsanctioned SaaS service. It is less direct than Investigate app permissions and related Defender for Cloud Apps detections. for the case at hand. This scenario concerns: A suspicious OAuth application requested excessive consent permissions.

Cloud Apps activity logs and file alerts show what happened in SaaS. This case concerns granted application permissions and associated detections; audit consent and scopes, then correlate with the app's anomaly events.

Linking a user and app registration to access rights identifies participating principals. It does not list the specific consent actors, granted API scopes and impacted users needed to characterize the permission exposure.

A time-ordered, multi-source incident chronology supports case reconstruction. It does not replace the detailed application-consent inventory showing who granted which scopes to whom.

“The investigation documents both devices and their correlated connections.” tests Two devices communicate through the same suspicious external infrastructure. It does not demonstrate the target outcome of The investigation lists granted scopes, consent actors and affected users. in the case described. This scenario concerns: A suspicious OAuth application requested excessive consent permissions.

The proposed action “Review Entra sign-in logs and risk detections for the account.” solves A risky sign-in indicates an unfamiliar device and anomalous travel. The present requirement is different: A third-party SaaS account shows repeated risky sign-ins from unfamiliar countries.

The option “Use the unified incident or entity view and correlate the account identifier.” would address An analyst needs to compare incidents linked to one compromised identity across XDR and Sentinel. It is less direct than Correlate Cloud Apps anomalous activity with Entra sign-in evidence. for the case at hand. This scenario concerns: A third-party SaaS account shows repeated risky sign-ins from unfamiliar countries.

“Investigate the Microsoft Defender for Cloud Apps anomaly and session evidence.” would prioritize A SaaS app is showing impossible download volume for a user account. That does not directly address the stated issue: A third-party SaaS account shows repeated risky sign-ins from unfamiliar countries.

A mail-click report identifies recipients who opened a suspicious URL. It does not capture the full identity sign-in case with timestamp, observed locations and risk disposition.

“The case links sign-in detail to the identity's known devices and travel context.” tests A risky sign-in indicates an unfamiliar device and anomalous travel. It does not demonstrate the target outcome of A single case records the timestamps, locations and risk assessment. in the case described. This scenario concerns: A third-party SaaS account shows repeated risky sign-ins from unfamiliar countries.

This proposed result, “The affected application, user and downloaded objects are identified.”, relates to A SaaS app is showing impossible download volume for a user account. It would not prove that Correlate Cloud Apps anomalous activity with Entra sign-in evidence. met the current requirement. This scenario concerns: A third-party SaaS account shows repeated risky sign-ins from unfamiliar countries.

The option “Enrich or map entities using source log fields and investigate the resulting identity links.” would address A Sentinel analytics incident includes only raw IP addresses, hiding which user is affected. It is less direct than Investigate the identity risk event and verify the user before choosing remediation. for the case at hand. This scenario concerns: An Entra ID user is flagged as at risk following a credential leak.

Defender for Cloud Apps anomalies are SaaS activity signals. An Entra ID Protection identity risk event needs user verification and sign-in risk context before deciding password reset or dismissal.

“Investigate app permissions and related Defender for Cloud Apps detections.” would prioritize A suspicious OAuth application requested excessive consent permissions. That does not directly address the stated issue: An Entra ID user is flagged as at risk following a credential leak.

A phishing campaign verdict and controlled prevention test evaluate mail-security policy. They do not record how an identity risk alert was validated and whether its user risk was reset or dismissed.

This proposed result, “The affected application, user and downloaded objects are identified.”, relates to A SaaS app is showing impossible download volume for a user account. It would not prove that Investigate the identity risk event and verify the user before choosing remediation. met the current requirement. This scenario concerns: An Entra ID user is flagged as at risk following a credential leak.

“The investigation links the user, application registration and access permissions.” may be appropriate evidence for A compromised Entra identity was used to register a new suspicious app., but the verification of the current incident must instead show The user-risk history and chosen reset or risk-dismissal outcome are documented. This scenario concerns: An Entra ID user is flagged as at risk following a credential leak.