Exam Bundle

Evidence supporting a targeted response rather than broad IP blocking is a containment recommendation. It does not show the analyst found the historical connections, ownership records and threat indicators associated with the selected entity.

This proposed result, “The responder records checked facts and any rejected unsupported Copilot claims.”, relates to Microsoft Security Copilot summarizes a complex incident and suggests containment. It would not prove that Pivot from the Sentinel alert entity into queryable logs and threat intelligence. met the current requirement. This scenario concerns: An alert contains an external IP but little context about related activity.

“The investigation documents both devices and their correlated connections.” may be appropriate evidence for Two devices communicate through the same suspicious external infrastructure., but the verification of the current incident must instead show The analyst finds historical connections, ownership context and relevant threat indicators. This scenario concerns: An alert contains an external IP but little context about related activity.

“Investigate Cloud Apps activity and endpoint transfer evidence for the same device and user.” would prioritize A defender-managed application is suspected of exfiltrating files to an unsanctioned SaaS service. That does not directly address the stated issue: A security incident needs reassignment to a specialist who owns ransomware investigations.

This alternative, “Validate the AI-generated summary against primary incident evidence before executing actions.”, is appropriate for Microsoft Security Copilot summarizes a complex incident and suggests containment. It does not establish the required outcome of The specialist receives a traceable case with triage notes and next actions. This scenario concerns: A security incident needs reassignment to a specialist who owns ransomware investigations.

The proposed action “Require documented classification and status changes in the case-management workflow.” solves Several responders are changing incident status without a recorded reason. The present requirement is different: A security incident needs reassignment to a specialist who owns ransomware investigations.

“The responder records checked facts and any rejected unsupported Copilot claims.” tests Microsoft Security Copilot summarizes a complex incident and suggests containment. It does not demonstrate the target outcome of The specialist receives a traceable case with triage notes and next actions. in the case described. This scenario concerns: A security incident needs reassignment to a specialist who owns ransomware investigations.

This proposed result, “The case history identifies who made each change and the reason.”, relates to Several responders are changing incident status without a recorded reason. It would not prove that Update the case owner and severity with a documented handoff in the incident record. met the current requirement. This scenario concerns: A security incident needs reassignment to a specialist who owns ransomware investigations.

A mail campaign scope and verdict can support an email-security investigation. The requested outcome is a traceable case for the assigned specialist containing triage notes and next actions, not just a prevention test.

“Investigate the Sentinel incident's alert list, entities and related events.” would prioritize Multiple Sentinel alerts represent stages of one intrusion and should be triaged together. That does not directly address the stated issue: An analyst needs to compare incidents linked to one compromised identity across XDR and Sentinel.

The proposed action “Contain the identity and verify authorization, session and affected application access before closure.” solves An analyst must recommend recovery actions after a confirmed compromised account. The present requirement is different: An analyst needs to compare incidents linked to one compromised identity across XDR and Sentinel.

The option “Locate matching email artifacts with Defender for Office 365 and apply authorized remediation.” would address An inbox contains emails with an attachment hash now classified as malware. It is less direct than Use the unified incident or entity view and correlate the account identifier. for the case at hand. This scenario concerns: An analyst needs to compare incidents linked to one compromised identity across XDR and Sentinel.

This proposed result, “The case identifies credential use and distinct source and destination hosts.”, relates to A privileged account is suspected of using pass-the-hash against a server. It would not prove that Use the unified incident or entity view and correlate the account identifier. met the current requirement. This scenario concerns: An analyst needs to compare incidents linked to one compromised identity across XDR and Sentinel.

“The analyst documents the linked sequence and shared attacker infrastructure.” may be appropriate evidence for Multiple Sentinel alerts represent stages of one intrusion and should be triaged together., but the verification of the current incident must instead show The findings include all relevant linked alerts without treating unrelated users as the same identity. This scenario concerns: An analyst needs to compare incidents linked to one compromised identity across XDR and Sentinel.

Session invalidation following suspect sign-ins validates identity containment. It does not prove the case includes all linked alerts while keeping unrelated users with similar identifiers separate.

This alternative, “Investigate the campaign's sender infrastructure and recipients across Defender XDR evidence.”, is appropriate for A suspected phishing campaign includes multiple lookalike sender domains. It does not establish the required outcome of The timeline orders initial access, execution and data access with matching entity identifiers. This scenario concerns: A campaign spreads from phishing to endpoint command execution and cloud file access.

The option “Compare the alert's identity behavior against documented service-account baselines.” would address A domain controller raises a Defender for Identity alert that may be a backup process. It is less direct than Reconstruct a multi-stage, multi-domain incident timeline from email, device and cloud evidence. for the case at hand. This scenario concerns: A campaign spreads from phishing to endpoint command execution and cloud file access.

Correlating device isolation timing with cloud sign-in/data transfer explains pre- versus post-containment activity. It does not reconstruct the entire sequence from initial phishing entry to execution and cloud access across multiple domains.

“The audit links the remediation to its rule, approver state and affected asset.” may be appropriate evidence for A closed incident is discovered to have unapproved automated remediation., but the verification of the current incident must instead show The timeline orders initial access, execution and data access with matching entity identifiers. This scenario concerns: A campaign spreads from phishing to endpoint command execution and cloud file access.

Determining whether a cloud action preceded containment answers one incident timing question. The required timeline also orders initial access, process execution and data access using the same verified entities.

Linking senders and mailboxes establishes an email campaign timeline. The current incident requires a broader intrusion chronology that orders initial access, process execution and data access using stable entity identifiers.

The proposed action “Compare the AI-generated incident narrative with entity and alert details in Defender XDR.” solves A Security Copilot summary omits a secondary compromised host. The present requirement is different: Two devices communicate through the same suspicious external infrastructure.

The option “Prioritize authoritative telemetry and human triage rather than automatically executing either suggestion.” would address An analyst receives conflicting recommendations from two AI-assisted investigation steps. It is less direct than Use incident entity relationships and network telemetry to identify lateral or parallel compromise. for the case at hand. This scenario concerns: Two devices communicate through the same suspicious external infrastructure.

Pivoting an alert into logs and TI enriches a single known indicator. Identifying lateral or parallel compromise requires explicit account-host and network relationship analysis across the other affected entities.

A comprehensive chronology can cite evidence across many attack stages. It does not necessarily demonstrate that the two specified devices and their network relationships are explicitly represented together in the investigation.

Application scopes and consent actors describe SaaS authorization. They do not establish the observed cross-device network connections linking the two hosts in this case.

“The analyst documents the container, image, node and triggering process.” tests A container workload reports suspicious process execution in a protected cluster. It does not demonstrate the target outcome of The investigation documents both devices and their correlated connections. in the case described. This scenario concerns: Two devices communicate through the same suspicious external infrastructure.

The option “Add verified business context and incident impact to the risk triage rather than relying solely on alert count.” would address The SOC wants to prioritize alerts from a sensitive executive identity during an active attack. It is less direct than Investigate privileged sign-ins and endpoint evidence for potential lateral movement. for the case at hand. This scenario concerns: A privileged administrator account appears on a previously unseen workstation during an active attack.

Revoking sessions is an identity-containment step after sufficient evidence. The present question asks for investigation of privileged sign-ins and endpoint traces to determine whether lateral movement occurred.

This alternative, “Reconstruct a multi-stage, multi-domain incident timeline from email, device and cloud evidence.”, is appropriate for A campaign spreads from phishing to endpoint command execution and cloud file access. It does not establish the required outcome of The timeline shows the exact user, host and session origin before containment. This scenario concerns: A privileged administrator account appears on a previously unseen workstation during an active attack.

“A previously issued session can no longer access the protected test resource.” tests A compromised account retains active refresh sessions after password reset. It does not demonstrate the target outcome of The timeline shows the exact user, host and session origin before containment. in the case described. This scenario concerns: A privileged administrator account appears on a previously unseen workstation during an active attack.

This proposed result, “The incident identifies the affected files, destination and approved next action.”, relates to A user account appears in a Purview DLP incident involving unusual external sharing. It would not prove that Investigate privileged sign-ins and endpoint evidence for potential lateral movement. met the current requirement. This scenario concerns: A privileged administrator account appears on a previously unseen workstation during an active attack.

“The case priority reflects asset criticality and supporting attack evidence.” may be appropriate evidence for The SOC wants to prioritize alerts from a sensitive executive identity during an active attack., but the verification of the current incident must instead show The timeline shows the exact user, host and session origin before containment. This scenario concerns: A privileged administrator account appears on a previously unseen workstation during an active attack.