Exam Bundle

Recording targeted service accounts and request sources captures part of a possible lateral-movement trail. The case also needs evidence linking the account-to-host path and determining whether it is actually suspicious.

“The final disposition distinguishes a sanctioned job from suspicious credential access.” tests A domain controller raises a Defender for Identity alert that may be a backup process. It does not demonstrate the target outcome of The investigation establishes whether the observed account-to-host path is suspicious. in the case described. This scenario concerns: A Defender for Identity alert suggests lateral movement using remote sessions.

This proposed result, “A new owner can reconstruct the case without relying on off-platform chat.”, relates to The SOC needs to preserve investigative findings when ownership changes during a long case. It would not prove that Review the source and destination entities and their related identity activity. met the current requirement. This scenario concerns: A Defender for Identity alert suggests lateral movement using remote sessions.

Documented case-classification changes preserve triage accountability. They do not establish whether Defender for Identity reconnaissance alerts correlate with Entra and endpoint evidence from the same suspected actor.

“Verify the disruption rationale and entity containment in the unified Defender XDR incident.” would prioritize An endpoint threat triggers cross-domain automatic attack disruption. That does not directly address the stated issue: The SOC finds repeated domain reconnaissance activity preceding a password-spray attack.

This alternative, “Correlate the cloud resource alert with identity and endpoint events in Defender XDR.”, is appropriate for A server with Defender for Cloud protection shows possible credential theft. It does not establish the required outcome of A unified timeline shows the reconnaissance followed by authentication attempts. This scenario concerns: The SOC finds repeated domain reconnaissance activity preceding a password-spray attack.

This proposed result, “The incident history documents which compromised assets were contained and why.”, relates to An endpoint threat triggers cross-domain automatic attack disruption. It would not prove that Correlate Defender for Identity reconnaissance alerts with related Entra and endpoint events. met the current requirement. This scenario concerns: The SOC finds repeated domain reconnaissance activity preceding a password-spray attack.

“The investigation lists granted scopes, consent actors and affected users.” may be appropriate evidence for A suspicious OAuth application requested excessive consent permissions., but the verification of the current incident must instead show A unified timeline shows the reconnaissance followed by authentication attempts. This scenario concerns: The SOC finds repeated domain reconnaissance activity preceding a password-spray attack.

An asset-criticality score influences case priority. The intended proof is an ordered reconnaissance-to-authentication timeline, so supporting events and timestamps matter more than the final severity label.

This alternative, “Investigate the Microsoft Defender for Cloud Apps anomaly and session evidence.”, is appropriate for A SaaS app is showing impossible download volume for a user account. It does not establish the required outcome of The case identifies credential use and distinct source and destination hosts. This scenario concerns: A privileged account is suspected of using pass-the-hash against a server.

The proposed action “Investigate the identity risk event and verify the user before choosing remediation.” solves An Entra ID user is flagged as at risk following a credential leak. The present requirement is different: A privileged account is suspected of using pass-the-hash against a server.

The option “Correlate the cloud resource alert with identity and endpoint events in Defender XDR.” would address A server with Defender for Cloud protection shows possible credential theft. It is less direct than Examine Defender for Identity alert details, logon sessions and affected devices. for the case at hand. This scenario concerns: A privileged account is suspected of using pass-the-hash against a server.

“Records identify the SaaS destination, transferred files and originating device.” may be appropriate evidence for A defender-managed application is suspected of exfiltrating files to an unsanctioned SaaS service., but the verification of the current incident must instead show The case identifies credential use and distinct source and destination hosts. This scenario concerns: A privileged account is suspected of using pass-the-hash against a server.

Case-change audit history records who edited an incident. It does not identify the credential, originating host and target host involved in the observed authentication path.

Mapping an app, user and downloaded data is useful for app abuse cases. It does not establish the distinct credential use and source/destination hosts required for this lateral-movement investigation.

The proposed action “Investigate the campaign's sender infrastructure and recipients across Defender XDR evidence.” solves A suspected phishing campaign includes multiple lookalike sender domains. The present requirement is different: Multiple Sentinel alerts represent stages of one intrusion and should be triaged together.

The option “Prioritize authoritative telemetry and human triage rather than automatically executing either suggestion.” would address An analyst receives conflicting recommendations from two AI-assisted investigation steps. It is less direct than Investigate the Sentinel incident's alert list, entities and related events. for the case at hand. This scenario concerns: Multiple Sentinel alerts represent stages of one intrusion and should be triaged together.

A unified incident/entity view helps correlate identities across sources. The request is to investigate the Sentinel case's own alert list, entity fields and supporting events before deciding the response.

“The analyst retains one coherent incident where alerts share the same attack sequence.” may be appropriate evidence for A high-severity Defender XDR incident has duplicate alerts from two workload sensors., but the verification of the current incident must instead show The analyst documents the linked sequence and shared attacker infrastructure. This scenario concerns: Multiple Sentinel alerts represent stages of one intrusion and should be triaged together.

Combining alerts belonging to the right identity avoids false joins, but the goal here is to document the actual attack sequence and shared infrastructure linking the incidents. Identity grouping alone does not establish that relationship.

“Follow-up sign-ins and token checks demonstrate that exposed sessions are no longer accepted.” tests An analyst must recommend recovery actions after a confirmed compromised account. It does not demonstrate the target outcome of The analyst documents the linked sequence and shared attacker infrastructure. in the case described. This scenario concerns: Multiple Sentinel alerts represent stages of one intrusion and should be triaged together.

The option “Use Microsoft Defender for Office 365 investigation and response to trace the message and remediate matching copies.” would address A user clicked a phishing link and multiple coworkers received the same message. It is less direct than Reopen the incident, attach the evidence and update its classification with rationale. for the case at hand. This scenario concerns: A Sentinel incident was closed as benign but new evidence suggests malicious activity.

Checking an AI-generated summary against source logs avoids unsupported automated actions. It does not reopen the previously closed case, attach the new threat evidence and formally revise its classification.

“Review Defender Action center and incident history to identify the triggering policy and action.” would prioritize A closed incident is discovered to have unapproved automated remediation. That does not directly address the stated issue: A Sentinel incident was closed as benign but new evidence suggests malicious activity.

An automation approval audit links a remediation to a rule and approver. It does not show that the reopened incident includes the new alert evidence and a documented change of disposition.

“The responder records checked facts and any rejected unsupported Copilot claims.” tests Microsoft Security Copilot summarizes a complex incident and suggests containment. It does not demonstrate the target outcome of The reopened case contains the new alert evidence and updated disposition. in the case described. This scenario concerns: A Sentinel incident was closed as benign but new evidence suggests malicious activity.

This proposed result, “The removal status and affected message set can be verified in the investigation.”, relates to A malware message was delivered, then later identified and removed automatically. It would not prove that Reopen the incident, attach the evidence and update its classification with rationale. met the current requirement. This scenario concerns: A Sentinel incident was closed as benign but new evidence suggests malicious activity.

The option “Inspect the identity alert and associated domain-controller evidence for abnormal service-ticket requests.” would address A Defender for Identity alert flags a possible Kerberoasting pattern. It is less direct than Pivot from the Sentinel alert entity into queryable logs and threat intelligence. for the case at hand. This scenario concerns: An alert contains an external IP but little context about related activity.

Validating process, URL and account timing helps decide containment after relevant records are assembled. The immediate analytic task is pivoting from the Sentinel alert entity into the logs and threat indicators that establish that context.

“Reconstruct a multi-stage, multi-domain incident timeline from email, device and cloud evidence.” would prioritize A campaign spreads from phishing to endpoint command execution and cloud file access. That does not directly address the stated issue: An alert contains an external IP but little context about related activity.

Evidence supporting a targeted response rather than broad IP blocking is a containment recommendation. It does not show the analyst found the historical connections, ownership records and threat indicators associated with the selected entity.

This proposed result, “The responder records checked facts and any rejected unsupported Copilot claims.”, relates to Microsoft Security Copilot summarizes a complex incident and suggests containment. It would not prove that Pivot from the Sentinel alert entity into queryable logs and threat intelligence. met the current requirement. This scenario concerns: An alert contains an external IP but little context about related activity.

“The investigation documents both devices and their correlated connections.” may be appropriate evidence for Two devices communicate through the same suspicious external infrastructure., but the verification of the current incident must instead show The analyst finds historical connections, ownership context and relevant threat indicators. This scenario concerns: An alert contains an external IP but little context about related activity.