Exam Bundle

Successful device isolation proves containment of network traffic. It does not link the suspicious installed service binary and installation time to the initiating user session.

This proposed result, “The approved application runs and the detection still identifies the malicious control sample.”, relates to A Windows endpoint reports a false-positive antivirus detection on a sanctioned application. It would not prove that Inspect service creation and persistence events in the endpoint timeline. met the current requirement. This scenario concerns: The SOC finds a potentially malicious service installed during an alert window.

“The investigation identifies the file, path, timestamp and correlated process.” may be appropriate evidence for An endpoint might have executed a malicious executable copied from a USB drive., but the verification of the current incident must instead show The investigation links the service binary and install timestamp to the suspicious user session. This scenario concerns: The SOC finds a potentially malicious service installed during an alert window.

Blocking a file indicator is an enforcement decision that may be justified later. The current investigation needs the file's signer, hash and prevalence to decide whether that block is appropriate.

“Assess evidence and use the supported release-from-isolation action for the approved device.” would prioritize An isolated machine has been remediated and must return to service. That does not directly address the stated issue: A responder must review a file's prevalence before declaring it malicious.

This alternative, “Examine the timeline and appropriate investigation package autoruns or registry evidence.”, is appropriate for An investigator needs to review an alert's related registry persistence indicators. It does not establish the required outcome of A supported verdict is recorded using relevant file characteristics and context. This scenario concerns: A responder must review a file's prevalence before declaring it malicious.

“A controlled sample is blocked under policy while unrelated applications work.” tests The endpoint response team wants to stop known malicious file execution without isolating every host. It does not demonstrate the target outcome of A supported verdict is recorded using relevant file characteristics and context. in the case described. This scenario concerns: A responder must review a file's prevalence before declaring it malicious.

This proposed result, “The action center provides the expected package and its collection status.”, relates to An analyst needs collected system state for a compromised endpoint but should not run destructive scripts. It would not prove that Open the file evidence or entity details in Defender for Endpoint for signer, hash and prevalence. met the current requirement. This scenario concerns: A responder must review a file's prevalence before declaring it malicious.

“The registry entry and process evidence show whether persistence was added.” may be appropriate evidence for An investigator needs to review an alert's related registry persistence indicators., but the verification of the current incident must instead show A supported verdict is recorded using relevant file characteristics and context. This scenario concerns: A responder must review a file's prevalence before declaring it malicious.

This alternative, “Start an authorized Defender for Endpoint live response session on the supported device.”, is appropriate for A suspicious device needs a remote shell to inspect running services. It does not establish the required outcome of The process tree and command lines distinguish sanctioned launch from abuse. This scenario concerns: An analyst sees an unusual parent-child process chain for a signed application.

The proposed action “Use supported remote response evidence collection under authorized live response, respecting platform limits.” solves An investigation needs process memory indicators but the analyst lacks direct desktop access. The present requirement is different: An analyst sees an unusual parent-child process chain for a signed application.

The option “Review the Defender for Endpoint device timeline for process and related events.” would address A workstation has suspicious command execution and the analyst needs the process ancestry. It is less direct than Use device process-tree evidence to determine whether the behavior is expected. for the case at hand. This scenario concerns: An analyst sees an unusual parent-child process chain for a signed application.

This proposed result, “The investigation records certificate metadata and the corresponding file hash.”, relates to A device entity has a suspicious executable with an unknown certificate. It would not prove that Use device process-tree evidence to determine whether the behavior is expected. met the current requirement. This scenario concerns: An analyst sees an unusual parent-child process chain for a signed application.

“A forensic evidence package is recorded and linked to the investigation.” may be appropriate evidence for An investigation needs process memory indicators but the analyst lacks direct desktop access., but the verification of the current incident must instead show The process tree and command lines distinguish sanctioned launch from abuse. This scenario concerns: An analyst sees an unusual parent-child process chain for a signed application.

A parent-child link identifies which process launched a suspicious child. Determining whether execution was sanctioned additionally requires the executable arguments and surrounding process-tree context, not only parent identity.

Remote response evidence collection can gather additional artifacts. It does not establish the final severity using the endpoint's already observed attack chain, active impact and case evidence.

Defender disruption and device action history show what containment happened. They do not alone assess the endpoint incident's overall severity and ongoing malicious behavior.

Certificate and signer evidence helps assess whether one file is trusted. It does not determine the incident severity across the device's multiple attack and response events.

A malware file verdict labels one artifact. The final incident severity must reflect the whole verified impact and whether active malicious activity persists.

Certificate metadata and a file hash provide artifact provenance. They cannot alone rank the severity of the observed attack chain or current business impact.

Citing the attack chain and isolation action supports a defensible report. The requested severity test also requires the selected priority to match verified impact and ongoing activity, not merely list evidence.

Choosing case severity from endpoint impact is triage, not prevention. A targeted file-indicator block must be scoped to affected devices so the identified artifact cannot execute or spread.

The option “Examine device timeline events and file-origin evidence around the suspected time.” would address An endpoint might have executed a malicious executable copied from a USB drive. It is less direct than Consider a supported file indicator block or restriction scoped to the affected population. for the case at hand. This scenario concerns: The endpoint response team wants to stop known malicious file execution without isolating every host.

“Open the file evidence or entity details in Defender for Endpoint for signer, hash and prevalence.” would prioritize A responder must review a file's prevalence before declaring it malicious. That does not directly address the stated issue: The endpoint response team wants to stop known malicious file execution without isolating every host.

A device's permission and configuration state explains whether live response commands are allowed. It does not test the application-control policy's ability to block the malicious sample while permitting unrelated approved applications.

“A supported verdict is recorded using relevant file characteristics and context.” tests A responder must review a file's prevalence before declaring it malicious. It does not demonstrate the target outcome of A controlled sample is blocked under policy while unrelated applications work. in the case described. This scenario concerns: The endpoint response team wants to stop known malicious file execution without isolating every host.

This proposed result, “The device status reflects decommissioning without losing required historical evidence.”, relates to A device is decommissioned but still appears as an active investigation target. It would not prove that Consider a supported file indicator block or restriction scoped to the affected population. met the current requirement. This scenario concerns: The endpoint response team wants to stop known malicious file execution without isolating every host.

Comparing network events around isolation tests containment effectiveness. It does not trigger or report the requested Defender antivirus scan on the endpoint.

“Assess evidence and use the supported release-from-isolation action for the approved device.” would prioritize An isolated machine has been remediated and must return to service. That does not directly address the stated issue: A suspected endpoint compromise has not been scanned since the last alert.

This alternative, “Request a Defender for Endpoint investigation package from the device.”, is appropriate for An analyst needs collected system state for a compromised endpoint but should not run destructive scripts. It does not establish the required outcome of Scan results and any remediation actions appear in the device activity history. This scenario concerns: A suspected endpoint compromise has not been scanned since the last alert.

“An authorized test confirms ordinary connectivity is restored and the action is logged.” tests An isolated machine has been remediated and must return to service. It does not demonstrate the target outcome of Scan results and any remediation actions appear in the device activity history. in the case described. This scenario concerns: A suspected endpoint compromise has not been scanned since the last alert.

This proposed result, “The item advances from pending to completed or rejected with a recorded disposition.”, relates to An endpoint investigation has an automated response pending analyst approval. It would not prove that Trigger an appropriate Defender for Endpoint antivirus scan on the investigated device. met the current requirement. This scenario concerns: A suspected endpoint compromise has not been scanned since the last alert.

“The timeline links the suspicious child process to its actual initiating parent.” may be appropriate evidence for A workstation has suspicious command execution and the analyst needs the process ancestry., but the verification of the current incident must instead show Scan results and any remediation actions appear in the device activity history. This scenario concerns: A suspected endpoint compromise has not been scanned since the last alert.