Exam Bundle

A phishing campaign verdict and controlled prevention test evaluate mail-security policy. They do not record how an identity risk alert was validated and whether its user risk was reset or dismissed.

This proposed result, “The affected application, user and downloaded objects are identified.”, relates to A SaaS app is showing impossible download volume for a user account. It would not prove that Investigate the identity risk event and verify the user before choosing remediation. met the current requirement. This scenario concerns: An Entra ID user is flagged as at risk following a credential leak.

“The investigation links the user, application registration and access permissions.” may be appropriate evidence for A compromised Entra identity was used to register a new suspicious app., but the verification of the current incident must instead show The user-risk history and chosen reset or risk-dismissal outcome are documented. This scenario concerns: An Entra ID user is flagged as at risk following a credential leak.

Cloud workload correlation connects a resource alert with host processes and network traffic. The requested identity investigation instead needs the account's Entra sign-in events and risk detections to establish authentication compromise.

“Correlate Cloud Apps anomalous activity with Entra sign-in evidence.” would prioritize A third-party SaaS account shows repeated risky sign-ins from unfamiliar countries. That does not directly address the stated issue: A risky sign-in indicates an unfamiliar device and anomalous travel.

The proposed action “Review Defender for Cloud Apps activity logs and file policy alerts.” solves A sanctioned cloud application suddenly starts sharing files outside policy. The present requirement is different: A risky sign-in indicates an unfamiliar device and anomalous travel.

This proposed result, “The investigation ties the destination IP to a specific process and VM.”, relates to A Defender for Cloud alert indicates a new outbound command-and-control connection from a VM. It would not prove that Review Entra sign-in logs and risk detections for the account. met the current requirement. This scenario concerns: A risky sign-in indicates an unfamiliar device and anomalous travel.

“A single case records the timestamps, locations and risk assessment.” may be appropriate evidence for A third-party SaaS account shows repeated risky sign-ins from unfamiliar countries., but the verification of the current incident must instead show The case links sign-in detail to the identity's known devices and travel context. This scenario concerns: A risky sign-in indicates an unfamiliar device and anomalous travel.

Cloud resource containment evidence documents alert response. It does not correlate the suspect sign-in with the user's known devices and plausible travel or location context.

“Contain the identity and verify authorization, session and affected application access before closure.” would prioritize An analyst must recommend recovery actions after a confirmed compromised account. That does not directly address the stated issue: A compromised account retains active refresh sessions after password reset.

This alternative, “Locate matching email artifacts with Defender for Office 365 and apply authorized remediation.”, is appropriate for An inbox contains emails with an attachment hash now classified as malware. It does not establish the required outcome of A previously issued session can no longer access the protected test resource. This scenario concerns: A compromised account retains active refresh sessions after password reset.

The proposed action “Investigate privileged sign-ins and endpoint evidence for potential lateral movement.” solves A privileged administrator account appears on a previously unseen workstation during an active attack. The present requirement is different: A compromised account retains active refresh sessions after password reset.

This proposed result, “The incident history documents which compromised assets were contained and why.”, relates to An endpoint threat triggers cross-domain automatic attack disruption. It would not prove that Evaluate revoking relevant sessions and other account containment in Entra ID. met the current requirement. This scenario concerns: A compromised account retains active refresh sessions after password reset.

“The timeline shows the exact user, host and session origin before containment.” may be appropriate evidence for A privileged administrator account appears on a previously unseen workstation during an active attack., but the verification of the current incident must instead show A previously issued session can no longer access the protected test resource. This scenario concerns: A compromised account retains active refresh sessions after password reset.

Follow-up sign-in attempts and token checks can show new sessions are safe or revoked. The direct requirement is that the previously issued session token fails to access the protected resource after remediation.

The proposed action “Investigate Entra authentication details and risk signals for possible MFA fatigue.” solves A user reports an unexpected MFA prompt immediately before a suspicious login. The present requirement is different: A service principal shows suspicious token issuance.

The option “Correlate the attachment hash with delivery, click and endpoint execution events.” would address The same malicious attachment is observed across multiple email campaigns. It is less direct than Investigate Entra workload-identity sign-in and permission activity rather than only user sign-ins. for the case at hand. This scenario concerns: A service principal shows suspicious token issuance.

Entra audit, sign-in and consent review can reveal application permission changes. The stated detection is specifically workload-identity activity, so query app/service-principal sign-ins rather than limiting the review to interactive users.

“The investigation links the user, application registration and access permissions.” may be appropriate evidence for A compromised Entra identity was used to register a new suspicious app., but the verification of the current incident must instead show The activity sequence identifies the app identity and anomalous access. This scenario concerns: A service principal shows suspicious token issuance.

A cross-domain chronology can establish an attack timeline. It does not identify the service-principal identity and anomalous permission use behind this specific workload access sequence.

A list of granted scopes and consent actors is application authorization evidence. It does not by itself prove which app identity performed the anomalous access operation and when.

The option “Review the source and destination entities and their related identity activity.” would address A Defender for Identity alert suggests lateral movement using remote sessions. It is less direct than Inspect the identity alert and associated domain-controller evidence for abnormal service-ticket requests. for the case at hand. This scenario concerns: A Defender for Identity alert flags a possible Kerberoasting pattern.

Reconstructing a broad incident attack sequence helps cross-entity triage. For suspected service-ticket abuse the analyst must inspect the identity alert and domain-controller authentication evidence, not only an overall timeline.

“Compare the alert's identity behavior against documented service-account baselines.” would prioritize A domain controller raises a Defender for Identity alert that may be a backup process. That does not directly address the stated issue: A Defender for Identity alert flags a possible Kerberoasting pattern.

Distinguishing a sanctioned scheduled job from suspicious login behavior determines whether an incident is malicious. Here the investigator needs the specific service accounts and request sources responsible for the event sequence.

DLP file and recipient findings identify possible data-exposure paths. The identity investigation must attribute service-account operations to their request origins rather than count sensitive files or recipients.

This proposed result, “The investigation establishes whether the observed account-to-host path is suspicious.”, relates to A Defender for Identity alert suggests lateral movement using remote sessions. It would not prove that Inspect the identity alert and associated domain-controller evidence for abnormal service-ticket requests. met the current requirement. This scenario concerns: A Defender for Identity alert flags a possible Kerberoasting pattern.

The option “Correlate Entra audit logs, Defender for Office evidence and device process history into one case.” would address A multistage intrusion combines identity compromise, suspicious mail rules and endpoint persistence. It is less direct than Review the source and destination entities and their related identity activity. for the case at hand. This scenario concerns: A Defender for Identity alert suggests lateral movement using remote sessions.

Comparing service-account behavior against a baseline detects deviations. It does not first establish the alert's source/destination entities and related identity actions, which determine the correct investigation scope.

“Inspect the identity alert and associated domain-controller evidence for abnormal service-ticket requests.” would prioritize A Defender for Identity alert flags a possible Kerberoasting pattern. That does not directly address the stated issue: A Defender for Identity alert suggests lateral movement using remote sessions.

Recording targeted service accounts and request sources captures part of a possible lateral-movement trail. The case also needs evidence linking the account-to-host path and determining whether it is actually suspicious.

“The final disposition distinguishes a sanctioned job from suspicious credential access.” tests A domain controller raises a Defender for Identity alert that may be a backup process. It does not demonstrate the target outcome of The investigation establishes whether the observed account-to-host path is suspicious. in the case described. This scenario concerns: A Defender for Identity alert suggests lateral movement using remote sessions.

This proposed result, “A new owner can reconstruct the case without relying on off-platform chat.”, relates to The SOC needs to preserve investigative findings when ownership changes during a long case. It would not prove that Review the source and destination entities and their related identity activity. met the current requirement. This scenario concerns: A Defender for Identity alert suggests lateral movement using remote sessions.