Exam Bundle

“A previously issued session can no longer access the protected test resource.” tests A compromised account retains active refresh sessions after password reset. It does not demonstrate the target outcome of The timeline shows the exact user, host and session origin before containment. in the case described. This scenario concerns: A privileged administrator account appears on a previously unseen workstation during an active attack.

This proposed result, “The incident identifies the affected files, destination and approved next action.”, relates to A user account appears in a Purview DLP incident involving unusual external sharing. It would not prove that Investigate privileged sign-ins and endpoint evidence for potential lateral movement. met the current requirement. This scenario concerns: A privileged administrator account appears on a previously unseen workstation during an active attack.

“The case priority reflects asset criticality and supporting attack evidence.” may be appropriate evidence for The SOC wants to prioritize alerts from a sensitive executive identity during an active attack., but the verification of the current incident must instead show The timeline shows the exact user, host and session origin before containment. This scenario concerns: A privileged administrator account appears on a previously unseen workstation during an active attack.

Recording a final verdict closes an investigation, but the question asks for active case management with shared notes, linked artifacts and tasks before that determination is reached.

This alternative, “Pivot from the Sentinel alert entity into queryable logs and threat intelligence.”, is appropriate for An alert contains an external IP but little context about related activity. It does not establish the required outcome of A new owner can reconstruct the case without relying on off-platform chat. This scenario concerns: The SOC needs to preserve investigative findings when ownership changes during a long case.

The proposed action “Add verified business context and incident impact to the risk triage rather than relying solely on alert count.” solves The SOC wants to prioritize alerts from a sensitive executive identity during an active attack. The present requirement is different: The SOC needs to preserve investigative findings when ownership changes during a long case.

“The case priority reflects asset criticality and supporting attack evidence.” tests The SOC wants to prioritize alerts from a sensitive executive identity during an active attack. It does not demonstrate the target outcome of A new owner can reconstruct the case without relying on off-platform chat. in the case described. This scenario concerns: The SOC needs to preserve investigative findings when ownership changes during a long case.

“The case documents the verified facts that resolved the conflict.” may be appropriate evidence for An analyst receives conflicting recommendations from two AI-assisted investigation steps., but the verification of the current incident must instead show A new owner can reconstruct the case without relying on off-platform chat. This scenario concerns: The SOC needs to preserve investigative findings when ownership changes during a long case.

A specialist receiving notes and next actions proves a handoff was sent. The next analyst must also be able to reconstruct the case from its durable evidence links and decision history without relying on off-platform chat.

“Update the case owner and severity with a documented handoff in the incident record.” would prioritize A security incident needs reassignment to a specialist who owns ransomware investigations. That does not directly address the stated issue: Several responders are changing incident status without a recorded reason.

The proposed action “Apply role and human-approval boundaries to agent-suggested security response actions.” solves An agentic AI incident workflow proposes revoking an account without approval. The present requirement is different: Several responders are changing incident status without a recorded reason.

The option “Correlate endpoint isolation timing with the user's cloud sign-in and data transfer.” would address An endpoint has an open ransomware alert while Sentinel shows malicious cloud storage access. It is less direct than Require documented classification and status changes in the case-management workflow. for the case at hand. This scenario concerns: Several responders are changing incident status without a recorded reason.

This proposed result, “The workflow records a required approval before performing the revocation.”, relates to An agentic AI incident workflow proposes revoking an account without approval. It would not prove that Require documented classification and status changes in the case-management workflow. met the current requirement. This scenario concerns: Several responders are changing incident status without a recorded reason.

An account-to-host path analysis can determine suspicious traversal. It does not provide the requested case-change history showing the actor, time and rationale for each incident update.

A specialist receiving case notes and next actions is a handoff result. It does not show who performed each earlier change in the case and why.

This alternative, “Investigate the Defender for Cloud workload-protection alert and relevant resource context.”, is appropriate for An Azure virtual machine has an active high-severity Defender for Cloud alert. It does not establish the required outcome of The receiving shift sees task owners, due context and evidence links. This scenario concerns: A regional SOC should hand off high-severity incidents with assigned follow-up tasks.

The option “Use incident case management with linked notes, evidence and tasks.” would address The SOC needs to preserve investigative findings when ownership changes during a long case. It is less direct than Create consistent incident handoff tasks and assign responsible responders. for the case at hand. This scenario concerns: A regional SOC should hand off high-severity incidents with assigned follow-up tasks.

Validating process and temporal evidence supports a containment decision. It does not assign responders and tracked handoff tasks within the incident-management workflow.

“The disposition distinguishes the false-positive alert from the confirmed malicious activity.” may be appropriate evidence for A Defender XDR incident includes one false-positive alert alongside genuine malware detections., but the verification of the current incident must instead show The receiving shift sees task owners, due context and evidence links. This scenario concerns: A regional SOC should hand off high-severity incidents with assigned follow-up tasks.

Keeping correlated alerts in one incident avoids fragmentation, but shift handoff requires explicit owners, due context and linked evidence so the receiving team knows what to do next.

“The attack path and affected VM activity are recorded in the security incident.” tests An Azure virtual machine has an active high-severity Defender for Cloud alert. It does not demonstrate the target outcome of The receiving shift sees task owners, due context and evidence links. in the case described. This scenario concerns: A regional SOC should hand off high-severity incidents with assigned follow-up tasks.

Human review of AI recommendations is necessary when using Copilot in response. The request is to document the final incident determination, supported by the case's actual primary evidence.

Case management provides notes, evidence links and task tracking, but those records can exist before a final judgment. Closure requires a determination supported by the observed alerts and investigative facts, not merely a populated case.

Defender for Office remediation audit records show how email items were handled. They do not independently justify the final threat determination for the wider incident.

A repeat mail search confirming quarantine establishes one remediation outcome. It does not prove the case severity and final disposition were based on the broader observed incident evidence.

A record of verified facts resolving a disagreement can support case closure. The required disposition must explicitly cite the relevant security events rather than rely on an unsupported severity label.

A single case containing times, locations and a risk assessment gives investigation context. It does not prove the final disposition explicitly references the source events supporting that assessment.

The option “Investigate the campaign's sender infrastructure and recipients across Defender XDR evidence.” would address A suspected phishing campaign includes multiple lookalike sender domains. It is less direct than Validate the AI-generated summary against primary incident evidence before executing actions. for the case at hand. This scenario concerns: Microsoft Security Copilot summarizes a complex incident and suggests containment.

Reopening a case and attaching new evidence updates an earlier disposition. The current safety control is validating any AI-generated incident summary against primary logs before performing response actions.

This alternative, “Compare the AI-generated incident narrative with entity and alert details in Defender XDR.”, is appropriate for A Security Copilot summary omits a secondary compromised host. It does not establish the required outcome of The responder records checked facts and any rejected unsupported Copilot claims. This scenario concerns: Microsoft Security Copilot summarizes a complex incident and suggests containment.

Adding the second host to a corrected case summary repairs missing entity scope. The requested test is that the responder separately records verified facts and rejects unsupported Copilot claims before taking action.

“The campaign investigation lists affected recipients and records completed message remediation.” tests A user clicked a phishing link and multiple coworkers received the same message. It does not demonstrate the target outcome of The responder records checked facts and any rejected unsupported Copilot claims. in the case described. This scenario concerns: Microsoft Security Copilot summarizes a complex incident and suggests containment.

This proposed result, “The specialist receives a traceable case with triage notes and next actions.”, relates to A security incident needs reassignment to a specialist who owns ransomware investigations. It would not prove that Validate the AI-generated summary against primary incident evidence before executing actions. met the current requirement. This scenario concerns: Microsoft Security Copilot summarizes a complex incident and suggests containment.