Exam Bundle

A remediation inventory confirms which phishing messages were removed. It does not demonstrate that distinct campaigns shared an identical file hash or another validated artifact link.

This proposed result, “The incident identifies the affected files, destination and approved next action.”, relates to A user account appears in a Purview DLP incident involving unusual external sharing. It would not prove that Correlate the attachment hash with delivery, click and endpoint execution events. met the current requirement. This scenario concerns: The same malicious attachment is observed across multiple email campaigns.

“The case identifies credential use and distinct source and destination hosts.” may be appropriate evidence for A privileged account is suspected of using pass-the-hash against a server., but the verification of the current incident must instead show The case shows distinct campaigns connected by the same file artifact. This scenario concerns: The same malicious attachment is observed across multiple email campaigns.

Human approval boundaries constrain agent-initiated security actions. The question instead asks responders to validate process, URL, account and time evidence before they choose containment.

“Review the sensitive-data event context and linked identity signals before remediation.” would prioritize A user account appears in a Purview DLP incident involving unusual external sharing. That does not directly address the stated issue: An incident's external IP belongs to a shared cloud service and is not sufficient proof of compromise.

The proposed action “Enrich or map entities using source log fields and investigate the resulting identity links.” solves A Sentinel analytics incident includes only raw IP addresses, hiding which user is affected. The present requirement is different: An incident's external IP belongs to a shared cloud service and is not sufficient proof of compromise.

“The investigation names a validated account and preserves source field provenance.” tests A Sentinel analytics incident includes only raw IP addresses, hiding which user is affected. It does not demonstrate the target outcome of The evidence supports a targeted response rather than blanket cloud-IP blocking. in the case described. This scenario concerns: An incident's external IP belongs to a shared cloud service and is not sufficient proof of compromise.

This proposed result, “The user-risk history and chosen reset or risk-dismissal outcome are documented.”, relates to An Entra ID user is flagged as at risk following a credential leak. It would not prove that Validate process, URL, account and temporal context before containment. met the current requirement. This scenario concerns: An incident's external IP belongs to a shared cloud service and is not sufficient proof of compromise.

“The audit links the remediation to its rule, approver state and affected asset.” may be appropriate evidence for A closed incident is discovered to have unapproved automated remediation., but the verification of the current incident must instead show The evidence supports a targeted response rather than blanket cloud-IP blocking. This scenario concerns: An incident's external IP belongs to a shared cloud service and is not sufficient proof of compromise.

“Enrich or map entities using source log fields and investigate the resulting identity links.” would prioritize A Sentinel analytics incident includes only raw IP addresses, hiding which user is affected. That does not directly address the stated issue: A closed incident is discovered to have unapproved automated remediation.

The proposed action “Reopen the incident, attach the evidence and update its classification with rationale.” solves A Sentinel incident was closed as benign but new evidence suggests malicious activity. The present requirement is different: A closed incident is discovered to have unapproved automated remediation.

The option “Compare the AI-generated incident narrative with entity and alert details in Defender XDR.” would address A Security Copilot summary omits a secondary compromised host. It is less direct than Review Defender Action center and incident history to identify the triggering policy and action. for the case at hand. This scenario concerns: A closed incident is discovered to have unapproved automated remediation.

This proposed result, “The event sequence identifies target service accounts and request sources.”, relates to A Defender for Identity alert flags a possible Kerberoasting pattern. It would not prove that Review Defender Action center and incident history to identify the triggering policy and action. met the current requirement. This scenario concerns: A closed incident is discovered to have unapproved automated remediation.

“The investigation names a validated account and preserves source field provenance.” may be appropriate evidence for A Sentinel analytics incident includes only raw IP addresses, hiding which user is affected., but the verification of the current incident must instead show The audit links the remediation to its rule, approver state and affected asset. This scenario concerns: A closed incident is discovered to have unapproved automated remediation.

Reopening a case with new alerts proves incident review resumed. It does not attribute a completed remediation to its triggering rule, approval state and affected device; inspect the action audit trail.

This alternative, “Use the unified incident or entity view and correlate the account identifier.”, is appropriate for An analyst needs to compare incidents linked to one compromised identity across XDR and Sentinel. It does not establish the required outcome of Follow-up sign-ins and token checks demonstrate that exposed sessions are no longer accepted. This scenario concerns: An analyst must recommend recovery actions after a confirmed compromised account.

The proposed action “Start from the unified incident evidence and reconstruct the attack sequence across entities.” solves The SOC receives a Defender XDR incident with alerts from email and endpoint products. The present requirement is different: An analyst must recommend recovery actions after a confirmed compromised account.

Session revocation can be part of containment but does not itself confirm the broader recovery and access-verification requirements.

Correct incident grouping prevents unrelated users' alerts from being merged. Session containment must instead be demonstrated by rejected follow-up sign-ins and unusable exposed tokens after revocation.

A previously issued session failing at one protected test resource is strong token-revocation evidence, but the required follow-up covers the affected sign-ins and exposed sessions as a set, not just one resource access.

“The incident history documents which compromised assets were contained and why.” tests An endpoint threat triggers cross-domain automatic attack disruption. It does not demonstrate the target outcome of Follow-up sign-ins and token checks demonstrate that exposed sessions are no longer accepted. in the case described. This scenario concerns: An analyst must recommend recovery actions after a confirmed compromised account.

The proposed action “Investigate Entra authentication details and risk signals for possible MFA fatigue.” solves A user reports an unexpected MFA prompt immediately before a suspicious login. The present requirement is different: A multistage intrusion combines identity compromise, suspicious mail rules and endpoint persistence.

The option “Pivot from Defender for Cloud alert to associated workload and runtime evidence.” would address A container workload reports suspicious process execution in a protected cluster. It is less direct than Correlate Entra audit logs, Defender for Office evidence and device process history into one case. for the case at hand. This scenario concerns: A multistage intrusion combines identity compromise, suspicious mail rules and endpoint persistence.

Entra app-consent and sign-in review characterizes application access. The incident needs an integrated chronology also incorporating Defender for Office email records and endpoint process activity.

An application identity and permission list can expose one stage of the incident. A complete chronology needs independent telemetry supporting email delivery, endpoint execution and subsequent cloud actions.

“Follow-up sign-ins and token checks demonstrate that exposed sessions are no longer accepted.” tests An analyst must recommend recovery actions after a confirmed compromised account. It does not demonstrate the target outcome of The final chronology supports each stage with independently sourced telemetry. in the case described. This scenario concerns: A multistage intrusion combines identity compromise, suspicious mail rules and endpoint persistence.

This proposed result, “The final disposition distinguishes a sanctioned job from suspicious credential access.”, relates to A domain controller raises a Defender for Identity alert that may be a backup process. It would not prove that Correlate Entra audit logs, Defender for Office evidence and device process history into one case. met the current requirement. This scenario concerns: A multistage intrusion combines identity compromise, suspicious mail rules and endpoint persistence.

The option “Examine device timeline events and file-origin evidence around the suspected time.” would address An endpoint might have executed a malicious executable copied from a USB drive. It is less direct than Review the Defender for Endpoint device timeline for process and related events. for the case at hand. This scenario concerns: A workstation has suspicious command execution and the analyst needs the process ancestry.

Collecting an endpoint investigation package captures forensic artifacts. The task is to inspect the device timeline for the relevant process and surrounding endpoint events before deciding whether additional collection is needed.

“Start an authorized Defender for Endpoint live response session on the supported device.” would prioritize A suspicious device needs a remote shell to inspect running services. That does not directly address the stated issue: A workstation has suspicious command execution and the analyst needs the process ancestry.

Linking a process to its network destination traces outbound activity. It does not identify which parent process actually launched the suspicious child and started that execution chain.

This proposed result, “The device status reflects decommissioning without losing required historical evidence.”, relates to A device is decommissioned but still appears as an active investigation target. It would not prove that Review the Defender for Endpoint device timeline for process and related events. met the current requirement. This scenario concerns: A workstation has suspicious command execution and the analyst needs the process ancestry.

“A forensic evidence package is recorded and linked to the investigation.” may be appropriate evidence for An investigation needs process memory indicators but the analyst lacks direct desktop access., but the verification of the current incident must instead show The timeline links the suspicious child process to its actual initiating parent. This scenario concerns: A workstation has suspicious command execution and the analyst needs the process ancestry.