Exam Bundle

Linking an email to process execution shows attack chronology. It does not separately document which alert was a false positive and which alert represented verified malicious behavior.

“The attack path and affected VM activity are recorded in the security incident.” tests An Azure virtual machine has an active high-severity Defender for Cloud alert. It does not demonstrate the target outcome of The disposition distinguishes the false-positive alert from the confirmed malicious activity. in the case described. This scenario concerns: A Defender XDR incident includes one false-positive alert alongside genuine malware detections.

This proposed result, “The analyst retains one coherent incident where alerts share the same attack sequence.”, relates to A high-severity Defender XDR incident has duplicate alerts from two workload sensors. It would not prove that Evaluate individual alert evidence and preserve the valid incident rather than closing everything as benign. met the current requirement. This scenario concerns: A Defender XDR incident includes one false-positive alert alongside genuine malware detections.

“Review Defender for Cloud Apps activity logs and file policy alerts.” would prioritize A sanctioned cloud application suddenly starts sharing files outside policy. That does not directly address the stated issue: A defender-managed application is suspected of exfiltrating files to an unsanctioned SaaS service.

This alternative, “Prioritize authoritative telemetry and human triage rather than automatically executing either suggestion.”, is appropriate for An analyst receives conflicting recommendations from two AI-assisted investigation steps. It does not establish the required outcome of Records identify the SaaS destination, transferred files and originating device. This scenario concerns: A defender-managed application is suspected of exfiltrating files to an unsanctioned SaaS service.

The proposed action “Investigate the Microsoft Defender for Cloud Apps anomaly and session evidence.” solves A SaaS app is showing impossible download volume for a user account. The present requirement is different: A defender-managed application is suspected of exfiltrating files to an unsanctioned SaaS service.

This proposed result, “The case identifies credential use and distinct source and destination hosts.”, relates to A privileged account is suspected of using pass-the-hash against a server. It would not prove that Investigate Cloud Apps activity and endpoint transfer evidence for the same device and user. met the current requirement. This scenario concerns: A defender-managed application is suspected of exfiltrating files to an unsanctioned SaaS service.

“The analyst identifies policy-matching files and the external recipients.” may be appropriate evidence for A sanctioned cloud application suddenly starts sharing files outside policy., but the verification of the current incident must instead show Records identify the SaaS destination, transferred files and originating device. This scenario concerns: A defender-managed application is suspected of exfiltrating files to an unsanctioned SaaS service.

An audit of changed privileges and telemetry gaps answers identity-governance questions. This incident instead needs evidence of the SaaS destination, specific files transferred and originating device.

“Investigate Entra workload-identity sign-in and permission activity rather than only user sign-ins.” would prioritize A service principal shows suspicious token issuance. That does not directly address the stated issue: A compromised Entra identity was used to register a new suspicious app.

This alternative, “Correlate Entra audit logs, Defender for Office evidence and device process history into one case.”, is appropriate for A multistage intrusion combines identity compromise, suspicious mail rules and endpoint persistence. It does not establish the required outcome of The investigation links the user, application registration and access permissions. This scenario concerns: A compromised Entra identity was used to register a new suspicious app.

The proposed action “Investigate the identity risk event and verify the user before choosing remediation.” solves An Entra ID user is flagged as at risk following a credential leak. The present requirement is different: A compromised Entra identity was used to register a new suspicious app.

This proposed result, “The final chronology supports each stage with independently sourced telemetry.”, relates to A multistage intrusion combines identity compromise, suspicious mail rules and endpoint persistence. It would not prove that Trace Entra audit and sign-in activity and evaluate app consent changes. met the current requirement. This scenario concerns: A compromised Entra identity was used to register a new suspicious app.

“The case links sign-in detail to the identity's known devices and travel context.” may be appropriate evidence for A risky sign-in indicates an unfamiliar device and anomalous travel., but the verification of the current incident must instead show The investigation links the user, application registration and access permissions. This scenario concerns: A compromised Entra identity was used to register a new suspicious app.

Listing affected downloaded objects identifies potential exposure. The requirement also needs the related user, application registration and granted access permissions that enabled the operation.

A justified final case determination does not recover missing underlying telemetry. The correct step is to correlate whatever audit, identity and endpoint records exist and document the coverage gap rather than infer deletion.

The proposed action “Review the source and destination entities and their related identity activity.” solves A Defender for Identity alert suggests lateral movement using remote sessions. The present requirement is different: An alert suggests an attacker deleted audit records after privilege escalation.

The option “Correlate endpoint isolation timing with the user's cloud sign-in and data transfer.” would address An endpoint has an open ransomware alert while Sentinel shows malicious cloud storage access. It is less direct than Correlate available audit, identity and endpoint logs rather than assume missing logs prove deletion. for the case at hand. This scenario concerns: An alert suggests an attacker deleted audit records after privilege escalation.

“The investigation establishes whether the observed account-to-host path is suspicious.” may be appropriate evidence for A Defender for Identity alert suggests lateral movement using remote sessions., but the verification of the current incident must instead show The case identifies actual privilege changes and any measurable telemetry gap. This scenario concerns: An alert suggests an attacker deleted audit records after privilege escalation.

Remediation rule and approver records provide action auditability. They do not establish the actual privilege modifications or identify gaps in event collection caused by the incident.

The source and target of service-account requests describe authentication activity. They do not provide the effective privilege changes and telemetry gap analysis requested for this case.

The option “Investigate the Defender for Cloud workload-protection alert and relevant resource context.” would address An Azure virtual machine has an active high-severity Defender for Cloud alert. It is less direct than Correlate its resource alert with host process and network connection evidence. for the case at hand. This scenario concerns: A Defender for Cloud alert indicates a new outbound command-and-control connection from a VM.

A broad XDR correlation across resource, identity and endpoint events is useful. This incident specifically requires tying the affected cloud resource alert to its host process and outbound network connection records.

“Add verified business context and incident impact to the risk triage rather than relying solely on alert count.” would prioritize The SOC wants to prioritize alerts from a sensitive executive identity during an active attack. That does not directly address the stated issue: A Defender for Cloud alert indicates a new outbound command-and-control connection from a VM.

Matching sign-ins and process traces can support an incident timeline. They do not necessarily associate the suspicious destination IP with the correct initiating process on the affected VM.

“The analyst documents the linked sequence and shared attacker infrastructure.” tests Multiple Sentinel alerts represent stages of one intrusion and should be triaged together. It does not demonstrate the target outcome of The investigation ties the destination IP to a specific process and VM. in the case described. This scenario concerns: A Defender for Cloud alert indicates a new outbound command-and-control connection from a VM.

This proposed result, “The attack path and affected VM activity are recorded in the security incident.”, relates to An Azure virtual machine has an active high-severity Defender for Cloud alert. It would not prove that Correlate its resource alert with host process and network connection evidence. met the current requirement. This scenario concerns: A Defender for Cloud alert indicates a new outbound command-and-control connection from a VM.

The option “Pivot from Defender for Cloud alert to associated workload and runtime evidence.” would address A container workload reports suspicious process execution in a protected cluster. It is less direct than Investigate Entra authentication details and risk signals for possible MFA fatigue. for the case at hand. This scenario concerns: A user reports an unexpected MFA prompt immediately before a suspicious login.

“Add verified business context and incident impact to the risk triage rather than relying solely on alert count.” would prioritize The SOC wants to prioritize alerts from a sensitive executive identity during an active attack. That does not directly address the stated issue: A user reports an unexpected MFA prompt immediately before a suspicious login.

This alternative, “Investigate Entra workload-identity sign-in and permission activity rather than only user sign-ins.”, is appropriate for A service principal shows suspicious token issuance. It does not establish the required outcome of The case records push attempts, sign-in result and source information. This scenario concerns: A user reports an unexpected MFA prompt immediately before a suspicious login.

“The analyst documents the container, image, node and triggering process.” tests A container workload reports suspicious process execution in a protected cluster. It does not demonstrate the target outcome of The case records push attempts, sign-in result and source information. in the case described. This scenario concerns: A user reports an unexpected MFA prompt immediately before a suspicious login.

This proposed result, “The campaign investigation lists affected recipients and records completed message remediation.”, relates to A user clicked a phishing link and multiple coworkers received the same message. It would not prove that Investigate Entra authentication details and risk signals for possible MFA fatigue. met the current requirement. This scenario concerns: A user reports an unexpected MFA prompt immediately before a suspicious login.

“The user-risk history and chosen reset or risk-dismissal outcome are documented.” may be appropriate evidence for An Entra ID user is flagged as at risk following a credential leak., but the verification of the current incident must instead show The case records push attempts, sign-in result and source information. This scenario concerns: A user reports an unexpected MFA prompt immediately before a suspicious login.