Exam Bundle

Linking a process to its network destination traces outbound activity. It does not identify which parent process actually launched the suspicious child and started that execution chain.

This proposed result, “The device status reflects decommissioning without losing required historical evidence.”, relates to A device is decommissioned but still appears as an active investigation target. It would not prove that Review the Defender for Endpoint device timeline for process and related events. met the current requirement. This scenario concerns: A workstation has suspicious command execution and the analyst needs the process ancestry.

“A forensic evidence package is recorded and linked to the investigation.” may be appropriate evidence for An investigation needs process memory indicators but the analyst lacks direct desktop access., but the verification of the current incident must instead show The timeline links the suspicious child process to its actual initiating parent. This scenario concerns: A workstation has suspicious command execution and the analyst needs the process ancestry.

A remote response package can collect additional forensic artifacts from a device. The initial task is to inspect existing device timeline and file-origin evidence around the suspected launch time before requesting more data.

“Consider a supported file indicator block or restriction scoped to the affected population.” would prioritize The endpoint response team wants to stop known malicious file execution without isolating every host. That does not directly address the stated issue: An endpoint might have executed a malicious executable copied from a USB drive.

This alternative, “Upload and run the vetted script through a properly authorized live response workflow.”, is appropriate for An analyst needs a custom PowerShell script executed on an investigated endpoint. It does not establish the required outcome of The investigation identifies the file, path, timestamp and correlated process. This scenario concerns: An endpoint might have executed a malicious executable copied from a USB drive.

“Scan results and any remediation actions appear in the device activity history.” tests A suspected endpoint compromise has not been scanned since the last alert. It does not demonstrate the target outcome of The investigation identifies the file, path, timestamp and correlated process. in the case described. This scenario concerns: An endpoint might have executed a malicious executable copied from a USB drive.

This proposed result, “The investigation records certificate metadata and the corresponding file hash.”, relates to A device entity has a suspicious executable with an unknown certificate. It would not prove that Examine device timeline events and file-origin evidence around the suspected time. met the current requirement. This scenario concerns: An endpoint might have executed a malicious executable copied from a USB drive.

“The live response command history records the script execution and output.” may be appropriate evidence for An analyst needs a custom PowerShell script executed on an investigated endpoint., but the verification of the current incident must instead show The investigation identifies the file, path, timestamp and correlated process. This scenario concerns: An endpoint might have executed a malicious executable copied from a USB drive.

“Start an authorized Defender for Endpoint live response session on the supported device.” would prioritize A suspicious device needs a remote shell to inspect running services. That does not directly address the stated issue: The SOC needs to contain a compromised Windows laptop while preserving Defender service communication.

This alternative, “Request a Defender for Endpoint investigation package from the device.”, is appropriate for An analyst needs collected system state for a compromised endpoint but should not run destructive scripts. It does not establish the required outcome of The laptop is isolated from normal network paths while management visibility remains available. This scenario concerns: The SOC needs to contain a compromised Windows laptop while preserving Defender service communication.

The option “Compare the action completion record with subsequent device telemetry and case requirements.” would address A defender action marked successful did not meet the incident containment goal. It is less direct than Use the supported Defender for Endpoint isolate-device response action with authorized approval. for the case at hand. This scenario concerns: The SOC needs to contain a compromised Windows laptop while preserving Defender service communication.

“The investigation links the service binary and install timestamp to the suspicious user session.” may be appropriate evidence for The SOC finds a potentially malicious service installed during an alert window., but the verification of the current incident must instead show The laptop is isolated from normal network paths while management visibility remains available. This scenario concerns: The SOC needs to contain a compromised Windows laptop while preserving Defender service communication.

An investigation package available in Action center confirms evidence collection. It does not isolate the laptop from normal network paths while retaining supported management access.

A process tree and command lines help decide whether execution is malicious. They do not show that the endpoint's network connections were restricted by the approved isolation action.

This alternative, “Consider a supported file indicator block or restriction scoped to the affected population.”, is appropriate for The endpoint response team wants to stop known malicious file execution without isolating every host. It does not establish the required outcome of An authorized test confirms ordinary connectivity is restored and the action is logged. This scenario concerns: An isolated machine has been remediated and must return to service.

The proposed action “Trigger an appropriate Defender for Endpoint antivirus scan on the investigated device.” solves A suspected endpoint compromise has not been scanned since the last alert. The present requirement is different: An isolated machine has been remediated and must return to service.

XDR disruption and device-action history document why an earlier containment occurred. Restoring connectivity now requires assessing current risk and using the supported release-from-isolation action for the specific approved device.

A record of why isolation began does not prove restored network connectivity after release. Verify permitted connections succeed again and that the containment change is logged.

Joining a process to its destination network activity reconstructs suspicious communications. It does not demonstrate an isolated laptop now has approved ordinary connectivity after release or that the release was logged.

“Scan results and any remediation actions appear in the device activity history.” tests A suspected endpoint compromise has not been scanned since the last alert. It does not demonstrate the target outcome of An authorized test confirms ordinary connectivity is restored and the action is logged. in the case described. This scenario concerns: An isolated machine has been remediated and must return to service.

The proposed action “Review the Defender for Endpoint device timeline for process and related events.” solves A workstation has suspicious command execution and the analyst needs the process ancestry. The present requirement is different: An analyst needs collected system state for a compromised endpoint but should not run destructive scripts.

An antivirus scan tests the device for malware and records scan/remediation results. It does not collect the requested Defender endpoint investigation package containing authorized forensic artifacts.

“Check device collection prerequisites and retry only after resolving the connectivity constraint.” would prioritize An endpoint's forensic package collection fails on a metered connection. That does not directly address the stated issue: An analyst needs collected system state for a compromised endpoint but should not run destructive scripts.

Changing an Action Center item's status documents a decision. The requested proof is a completed investigation-package collection whose artifact can be retrieved from the action record.

“The live response command history records the script execution and output.” tests An analyst needs a custom PowerShell script executed on an investigated endpoint. It does not demonstrate the target outcome of The action center provides the expected package and its collection status. in the case described. This scenario concerns: An analyst needs collected system state for a compromised endpoint but should not run destructive scripts.

This proposed result, “A forensic evidence package is recorded and linked to the investigation.”, relates to An investigation needs process memory indicators but the analyst lacks direct desktop access. It would not prove that Request a Defender for Endpoint investigation package from the device. met the current requirement. This scenario concerns: An analyst needs collected system state for a compromised endpoint but should not run destructive scripts.

The option “Use the supported Defender for Endpoint isolate-device response action with authorized approval.” would address The SOC needs to contain a compromised Windows laptop while preserving Defender service communication. It is less direct than Start an authorized Defender for Endpoint live response session on the supported device. for the case at hand. This scenario concerns: A suspicious device needs a remote shell to inspect running services.

The device timeline is a read-only record of historical endpoint events. A live response session requires eligible device support, approved responder permissions and an actual authorized session connection.

“Upload and run the vetted script through a properly authorized live response workflow.” would prioritize An analyst needs a custom PowerShell script executed on an investigated endpoint. That does not directly address the stated issue: A suspicious device needs a remote shell to inspect running services.

“The investigation identifies the file, path, timestamp and correlated process.” tests An endpoint might have executed a malicious executable copied from a USB drive. It does not demonstrate the target outcome of The session logs allowed commands and returns the requested service information. in the case described. This scenario concerns: A suspicious device needs a remote shell to inspect running services.

This proposed result, “The investigation records certificate metadata and the corresponding file hash.”, relates to A device entity has a suspicious executable with an unknown certificate. It would not prove that Start an authorized Defender for Endpoint live response session on the supported device. met the current requirement. This scenario concerns: A suspicious device needs a remote shell to inspect running services.

“The timeline links the suspicious child process to its actual initiating parent.” may be appropriate evidence for A workstation has suspicious command execution and the analyst needs the process ancestry., but the verification of the current incident must instead show The session logs allowed commands and returns the requested service information. This scenario concerns: A suspicious device needs a remote shell to inspect running services.