Exam Bundle

Live-response command history records that a script ran. It does not correlate the original execution process and device to the suspicious destination network connection.

“The timeline links the suspicious child process to its actual initiating parent.” tests A workstation has suspicious command execution and the analyst needs the process ancestry. It does not demonstrate the target outcome of The same device and process context links the execution to the destination. in the case described. This scenario concerns: The endpoint timeline shows a process launched just before a suspicious external DNS query.

“The process tree and command lines distinguish sanctioned launch from abuse.” may be appropriate evidence for An analyst sees an unusual parent-child process chain for a signed application., but the verification of the current incident must instead show The same device and process context links the execution to the destination. This scenario concerns: The endpoint timeline shows a process launched just before a suspicious external DNS query.

Requesting an investigation package collects evidence from an active endpoint. The current device is being decommissioned, so its inventory state and supported offboarding/cleanup workflow must be reviewed.

“Submit the file through a supported Defender investigation or analysis workflow without executing it.” would prioritize A downloaded malware sample is suspected but not yet classified. That does not directly address the stated issue: A device is decommissioned but still appears as an active investigation target.

The proposed action “Use device process-tree evidence to determine whether the behavior is expected.” solves An analyst sees an unusual parent-child process chain for a signed application. The present requirement is different: A device is decommissioned but still appears as an active investigation target.

“The analysis returns a verdict linked to the submitted sample hash.” tests A downloaded malware sample is suspected but not yet classified. It does not demonstrate the target outcome of The device status reflects decommissioning without losing required historical evidence. in the case described. This scenario concerns: A device is decommissioned but still appears as an active investigation target.

“A forensic evidence package is recorded and linked to the investigation.” may be appropriate evidence for An investigation needs process memory indicators but the analyst lacks direct desktop access., but the verification of the current incident must instead show The device status reflects decommissioning without losing required historical evidence. This scenario concerns: A device is decommissioned but still appears as an active investigation target.

Antivirus scan and remediation history describe threat response on an endpoint. They do not show the device was correctly decommissioned while preserving required historical investigation records.

“Use the supported Defender for Endpoint isolate-device response action with authorized approval.” would prioritize The SOC needs to contain a compromised Windows laptop while preserving Defender service communication. That does not directly address the stated issue: A defender action marked successful did not meet the incident containment goal.

This alternative, “Inspect file evidence for signer and certificate details before making a trust decision.”, is appropriate for A device entity has a suspicious executable with an unknown certificate. It does not establish the required outcome of Follow-up evidence demonstrates whether the threat was actually contained. This scenario concerns: A defender action marked successful did not meet the incident containment goal.

The proposed action “Trigger an appropriate Defender for Endpoint antivirus scan on the investigated device.” solves A suspected endpoint compromise has not been scanned since the last alert. The present requirement is different: A defender action marked successful did not meet the incident containment goal.

This proposed result, “A supported verdict is recorded using relevant file characteristics and context.”, relates to A responder must review a file's prevalence before declaring it malicious. It would not prove that Compare the action completion record with subsequent device telemetry and case requirements. met the current requirement. This scenario concerns: A defender action marked successful did not meet the incident containment goal.

“The registry entry and process evidence show whether persistence was added.” may be appropriate evidence for An investigator needs to review an alert's related registry persistence indicators., but the verification of the current incident must instead show Follow-up evidence demonstrates whether the threat was actually contained. This scenario concerns: A defender action marked successful did not meet the incident containment goal.

A submitted file's analysis verdict characterizes one artifact. It does not demonstrate the overall threat was contained; follow-up process, connection and device evidence is needed.

This alternative, “Use an authorized Microsoft Purview eDiscovery content search with defined custodians and locations.”, is appropriate for An organization needs to locate items matching an investigation keyword across Microsoft 365 workloads. It does not establish the required outcome of Audit records identify the actor, affected mailbox, action and timestamp. This scenario concerns: A Microsoft 365 administrator suspects an attacker changed mailbox forwarding settings.

The proposed action “Find the relevant SharePoint or OneDrive sharing operations in Purview Audit.” solves A file was shared anonymously from OneDrive during an insider-risk investigation. The present requirement is different: A Microsoft 365 administrator suspects an attacker changed mailbox forwarding settings.

The option “Investigate relevant download and deletion audit events with the same file identifiers.” would address A Microsoft 365 user deletes a SharePoint file after an anomalous download. It is less direct than Search Microsoft Purview Audit for relevant mailbox and forwarding configuration events. for the case at hand. This scenario concerns: A Microsoft 365 administrator suspects an attacker changed mailbox forwarding settings.

“Records establish event ordering and the account responsible.” may be appropriate evidence for A Microsoft 365 user deletes a SharePoint file after an anomalous download., but the verification of the current incident must instead show Audit records identify the actor, affected mailbox, action and timestamp. This scenario concerns: A Microsoft 365 administrator suspects an attacker changed mailbox forwarding settings.

Message-interaction timestamps linked to mailbox setting changes support a chronology. The requested audit evidence must explicitly identify the actor, affected mailbox, operation and timestamp of the change.

An app-identity API operation record documents a different principal and resource type. It does not establish which user changed the mailbox configuration.

The proposed action “Build a cross-workload timeline from Purview Audit, eDiscovery metadata and Graph request logs.” solves A suspected compromise involves email forwarding, file sharing and Graph application activity. The present requirement is different: A SharePoint site owner reports a large number of downloaded documents overnight.

Download and delete audit events for a file track content operations. The current search requires Purview Audit records identifying account activity and file download, without conflating it with deletion.

Sorting unrelated sign-in events cannot establish who downloaded the SharePoint files. The keyed investigation searches file-download audit operations and actor context.

A burst query can identify abnormal cloud-resource requests without quantifying files taken. The required exfiltration assessment must count affected objects and link those downloads to the source user and session.

“Records establish event ordering and the account responsible.” tests A Microsoft 365 user deletes a SharePoint file after an anomalous download. It does not demonstrate the target outcome of The investigation counts affected files and ties them to the source user and session. in the case described. This scenario concerns: A SharePoint site owner reports a large number of downloaded documents overnight.

This proposed result, “The final case links identity, mail settings, shared files and app activity using source evidence.”, relates to A suspected compromise involves email forwarding, file sharing and Graph application activity. It would not prove that Search Purview Audit for matching file download operations and account activity. met the current requirement. This scenario concerns: A SharePoint site owner reports a large number of downloaded documents overnight.

The option “Search Microsoft Purview Audit for relevant mailbox and forwarding configuration events.” would address A Microsoft 365 administrator suspects an attacker changed mailbox forwarding settings. It is less direct than Verify audit availability, retention and search range before concluding the activity never happened. for the case at hand. This scenario concerns: A privileged administrator says no audit records exist for a suspicious change.

“Query the supported Microsoft 365 audit events for group or Teams membership modifications.” would prioritize An analyst wants to investigate a suspicious Teams membership change. That does not directly address the stated issue: A privileged administrator says no audit records exist for a suspicious change.

This alternative, “Investigate relevant download and deletion audit events with the same file identifiers.”, is appropriate for A Microsoft 365 user deletes a SharePoint file after an anomalous download. It does not establish the required outcome of A test control action is retrievable under the corrected scope or a documented gap is identified. This scenario concerns: A privileged administrator says no audit records exist for a suspicious change.

A mailbox action audit entry shows an actor and configuration change. It does not demonstrate a controlled event can be found under the newly corrected query scope or identify an actual audit coverage gap.

“The correlated history ties old and new filenames to the same document identity.” tests A respondent asks which account accessed a document but the file title changed. It does not demonstrate the target outcome of A test control action is retrievable under the corrected scope or a documented gap is identified. in the case described. This scenario concerns: A privileged administrator says no audit records exist for a suspicious change.

“The returned record identifies the target group and initiating account.” may be appropriate evidence for An analyst wants to investigate a suspicious Teams membership change., but the verification of the current incident must instead show A test control action is retrievable under the corrected scope or a documented gap is identified. This scenario concerns: A privileged administrator says no audit records exist for a suspicious change.