Exam Bundle

Adding the second host to a corrected case summary repairs missing entity scope. The requested test is that the responder separately records verified facts and rejects unsupported Copilot claims before taking action.

“The campaign investigation lists affected recipients and records completed message remediation.” tests A user clicked a phishing link and multiple coworkers received the same message. It does not demonstrate the target outcome of The responder records checked facts and any rejected unsupported Copilot claims. in the case described. This scenario concerns: Microsoft Security Copilot summarizes a complex incident and suggests containment.

This proposed result, “The specialist receives a traceable case with triage notes and next actions.”, relates to A security incident needs reassignment to a specialist who owns ransomware investigations. It would not prove that Validate the AI-generated summary against primary incident evidence before executing actions. met the current requirement. This scenario concerns: Microsoft Security Copilot summarizes a complex incident and suggests containment.

Requiring documented classification and status changes makes incident administration auditable. It does not prevent an agent's proposed security action from executing without the role authorization and human approval appropriate to that action.

“Review the sensitive-data event context and linked identity signals before remediation.” would prioritize A user account appears in a Purview DLP incident involving unusual external sharing. That does not directly address the stated issue: An agentic AI incident workflow proposes revoking an account without approval.

This alternative, “Review Defender for Office 365 campaign and message investigation evidence before adding a narrow block.”, is appropriate for A deceptive sender passed basic spam checks and delivered credential-harvesting email. It does not establish the required outcome of The workflow records a required approval before performing the revocation. This scenario concerns: An agentic AI incident workflow proposes revoking an account without approval.

This proposed result, “The audit links the remediation to its rule, approver state and affected asset.”, relates to A closed incident is discovered to have unapproved automated remediation. It would not prove that Apply role and human-approval boundaries to agent-suggested security response actions. met the current requirement. This scenario concerns: An agentic AI incident workflow proposes revoking an account without approval.

“The incident identifies the affected files, destination and approved next action.” may be appropriate evidence for A user account appears in a Purview DLP incident involving unusual external sharing., but the verification of the current incident must instead show The workflow records a required approval before performing the revocation. This scenario concerns: An agentic AI incident workflow proposes revoking an account without approval.

An audit log showing who changed case status establishes accountability after an update. The requested control must capture approval before an identity revocation is actually executed.

“Inspect the identity alert and associated domain-controller evidence for abnormal service-ticket requests.” would prioritize A Defender for Identity alert flags a possible Kerberoasting pattern. That does not directly address the stated issue: A Security Copilot summary omits a secondary compromised host.

The issue is an omitted compromised host. Accepting the summary without checking the underlying incident evidence leaves that omission unaddressed.

The option “Use the unified incident or entity view and correlate the account identifier.” would address An analyst needs to compare incidents linked to one compromised identity across XDR and Sentinel. It is less direct than Compare the AI-generated incident narrative with entity and alert details in Defender XDR. for the case at hand. This scenario concerns: A Security Copilot summary omits a secondary compromised host.

“The investigation ties the destination IP to a specific process and VM.” may be appropriate evidence for A Defender for Cloud alert indicates a new outbound command-and-control connection from a VM., but the verification of the current incident must instead show The corrected summary includes the second host and references evidence. This scenario concerns: A Security Copilot summary omits a secondary compromised host.

Checking revoked sessions verifies account containment. It does not repair the incomplete AI-generated summary by adding the second affected host and citing the source evidence.

Recording rejected unsupported Copilot claims improves analyst diligence, but the required output also needs the second host added with supporting logs, not just a record of the review process.

This alternative, “Use incident entity relationships and network telemetry to identify lateral or parallel compromise.”, is appropriate for Two devices communicate through the same suspicious external infrastructure. It does not establish the required outcome of The case documents the verified facts that resolved the conflict. This scenario concerns: An analyst receives conflicting recommendations from two AI-assisted investigation steps.

A justified case disposition resolves the final classification using evidence. When two conflicting recommendations have just arrived, the immediate safe step is to examine primary telemetry and apply human triage before executing either action.

Searching and remediating matching phishing messages addresses an email threat. It does not resolve conflicting incident-response advice until a responder compares the underlying evidence and decides which recommendation is supported.

A case disposition citing supporting events documents a defensible final severity. The case must additionally capture which verified facts reconciled the specific conflicting reports rather than merely display a final label.

Correlated network connections between two devices can support the case facts, but do not by themselves document the evidence-based resolution of the disagreement under review.

“The case identifies credential use and distinct source and destination hosts.” tests A privileged account is suspected of using pass-the-hash against a server. It does not demonstrate the target outcome of The case documents the verified facts that resolved the conflict. in the case described. This scenario concerns: An analyst receives conflicting recommendations from two AI-assisted investigation steps.

The option “Investigate the Defender for Cloud workload-protection alert and relevant resource context.” would address An Azure virtual machine has an active high-severity Defender for Cloud alert. It is less direct than Inspect correlation and entity evidence before creating a second case. for the case at hand. This scenario concerns: A high-severity Defender XDR incident has duplicate alerts from two workload sensors.

Reconstructing attack stages across entities helps understand scope after a case is built. The immediate decision is whether new alerts actually belong to the current incident before creating a duplicate case.

“Investigate app permissions and related Defender for Cloud Apps detections.” would prioritize A suspicious OAuth application requested excessive consent permissions. That does not directly address the stated issue: A high-severity Defender XDR incident has duplicate alerts from two workload sensors.

Correlating one email delivery to endpoint execution establishes a specific incident link. It does not show that all relevant alerts were consolidated into one coherent case rather than split into duplicate investigations.

A list of affected files and a proposed next action captures exfiltration scope. It does not establish that correlated alerts were preserved under the same attack-sequence incident.

This proposed result, “The attack path and affected VM activity are recorded in the security incident.”, relates to An Azure virtual machine has an active high-severity Defender for Cloud alert. It would not prove that Inspect correlation and entity evidence before creating a second case. met the current requirement. This scenario concerns: A high-severity Defender XDR incident has duplicate alerts from two workload sensors.

The option “Inspect correlation and entity evidence before creating a second case.” would address A high-severity Defender XDR incident has duplicate alerts from two workload sensors. It is less direct than Evaluate individual alert evidence and preserve the valid incident rather than closing everything as benign. for the case at hand. This scenario concerns: A Defender XDR incident includes one false-positive alert alongside genuine malware detections.

Correlating a cloud alert with identity and endpoint evidence can expand an investigation. It does not justify closing every alert as benign when some individual alerts still have confirmed malicious evidence.

“Start from the unified incident evidence and reconstruct the attack sequence across entities.” would prioritize The SOC receives a Defender XDR incident with alerts from email and endpoint products. That does not directly address the stated issue: A Defender XDR incident includes one false-positive alert alongside genuine malware detections.

Linking an email to process execution shows attack chronology. It does not separately document which alert was a false positive and which alert represented verified malicious behavior.

“The attack path and affected VM activity are recorded in the security incident.” tests An Azure virtual machine has an active high-severity Defender for Cloud alert. It does not demonstrate the target outcome of The disposition distinguishes the false-positive alert from the confirmed malicious activity. in the case described. This scenario concerns: A Defender XDR incident includes one false-positive alert alongside genuine malware detections.

This proposed result, “The analyst retains one coherent incident where alerts share the same attack sequence.”, relates to A high-severity Defender XDR incident has duplicate alerts from two workload sensors. It would not prove that Evaluate individual alert evidence and preserve the valid incident rather than closing everything as benign. met the current requirement. This scenario concerns: A Defender XDR incident includes one false-positive alert alongside genuine malware detections.