Exam Bundle

A mailbox action audit entry shows an actor and configuration change. It does not demonstrate a controlled event can be found under the newly corrected query scope or identify an actual audit coverage gap.

“The correlated history ties old and new filenames to the same document identity.” tests A respondent asks which account accessed a document but the file title changed. It does not demonstrate the target outcome of A test control action is retrievable under the corrected scope or a documented gap is identified. in the case described. This scenario concerns: A privileged administrator says no audit records exist for a suspicious change.

“The returned record identifies the target group and initiating account.” may be appropriate evidence for An analyst wants to investigate a suspicious Teams membership change., but the verification of the current incident must instead show A test control action is retrievable under the corrected scope or a documented gap is identified. This scenario concerns: A privileged administrator says no audit records exist for a suspicious change.

“Verify audit availability, retention and search range before concluding the activity never happened.” would prioritize A privileged administrator says no audit records exist for a suspicious change. That does not directly address the stated issue: An analyst wants to investigate a suspicious Teams membership change.

This alternative, “Order Purview audit activity by event time and correlate related file operations.”, is appropriate for An analyst investigates a data export but wants the first event, not only the latest download. It does not establish the required outcome of The returned record identifies the target group and initiating account. This scenario concerns: An analyst wants to investigate a suspicious Teams membership change.

The proposed action “Save the approved Purview Audit search parameters and preserve exported event evidence.” solves A SOC manager wants a reproducible investigation of who altered a tenant policy. The present requirement is different: An analyst wants to investigate a suspicious Teams membership change.

“A test control action is retrievable under the corrected scope or a documented gap is identified.” tests A privileged administrator says no audit records exist for a suspicious change. It does not demonstrate the target outcome of The returned record identifies the target group and initiating account. in the case described. This scenario concerns: An analyst wants to investigate a suspicious Teams membership change.

This proposed result, “The timeline reveals when access began and how export volume grew.”, relates to An analyst investigates a data export but wants the first event, not only the latest download. It would not prove that Query the supported Microsoft 365 audit events for group or Teams membership modifications. met the current requirement. This scenario concerns: An analyst wants to investigate a suspicious Teams membership change.

An event sequence with account attribution establishes ordering. It does not specifically identify the target group and initiating account for the membership-change record under investigation.

This alternative, “Query the supported Microsoft 365 audit events for group or Teams membership modifications.”, is appropriate for An analyst wants to investigate a suspicious Teams membership change. It does not establish the required outcome of Timestamps connect the message interaction to the mailbox configuration change. This scenario concerns: A suspicious inbox rule was created shortly after a user clicked a phishing email.

The proposed action “Find the relevant SharePoint or OneDrive sharing operations in Purview Audit.” solves A file was shared anonymously from OneDrive during an insider-risk investigation. The present requirement is different: A suspicious inbox rule was created shortly after a user clicked a phishing email.

The option “Build a cross-workload timeline from Purview Audit, eDiscovery metadata and Graph request logs.” would address A suspected compromise involves email forwarding, file sharing and Graph application activity. It is less direct than Correlate Purview audit records for inbox-rule changes with Defender email evidence. for the case at hand. This scenario concerns: A suspicious inbox rule was created shortly after a user clicked a phishing email.

“Records establish event ordering and the account responsible.” may be appropriate evidence for A Microsoft 365 user deletes a SharePoint file after an anomalous download., but the verification of the current incident must instead show Timestamps connect the message interaction to the mailbox configuration change. This scenario concerns: A suspicious inbox rule was created shortly after a user clicked a phishing email.

An all-workload case connects identity, mail, file and app events for broad triage. Here the analyst must pinpoint when message interaction preceded or followed a specific mailbox configuration edit, using exact timestamps.

A group-change record identifies which group and user were involved. It does not link the email interaction timestamp to the later mailbox configuration change as requested.

This alternative, “Search Purview Audit for matching file download operations and account activity.”, is appropriate for A SharePoint site owner reports a large number of downloaded documents overnight. It does not establish the required outcome of Records show the initiating user, file and sharing-link operation. This scenario concerns: A file was shared anonymously from OneDrive during an insider-risk investigation.

The proposed action “Build a cross-workload timeline from Purview Audit, eDiscovery metadata and Graph request logs.” solves A suspected compromise involves email forwarding, file sharing and Graph application activity. The present requirement is different: A file was shared anonymously from OneDrive during an insider-risk investigation.

Saving approved audit query parameters and evidence export ensures repeatability. It does not locate the SharePoint or OneDrive sharing operations within those audit records in the first place.

An ordered series with a responsible account can support chronology. The required result is the exact file and sharing-link operation initiated by that user, not just event ordering.

A controlled audit action being retrievable under corrected scope shows the audit query works. It does not prove the actual file-sharing record includes the user, file and link operation.

“The search estimate and results show which scoped content matches the test query.” tests An organization needs to locate items matching an investigation keyword across Microsoft 365 workloads. It does not demonstrate the target outcome of Records show the initiating user, file and sharing-link operation. in the case described. This scenario concerns: A file was shared anonymously from OneDrive during an insider-risk investigation.

Searching one user's mailbox alone can miss relevant items in other Exchange mailboxes, SharePoint sites, OneDrive accounts and Teams locations. Add the approved sources for each workload to the case search before running the keyword query.

The option “Search Microsoft Purview Audit for relevant mailbox and forwarding configuration events.” would address A Microsoft 365 administrator suspects an attacker changed mailbox forwarding settings. It is less direct than Use an authorized Microsoft Purview eDiscovery content search with defined custodians and locations. for the case at hand. This scenario concerns: An organization needs to locate items matching an investigation keyword across Microsoft 365 workloads.

“Order Purview audit activity by event time and correlate related file operations.” would prioritize An analyst investigates a data export but wants the first event, not only the latest download. That does not directly address the stated issue: An organization needs to locate items matching an investigation keyword across Microsoft 365 workloads.

Event ordering and actor attribution can support an investigation. The test here measures the content search's scope and the count of records matching its custodian/location query.

“Audit records identify the actor, affected mailbox, action and timestamp.” tests A Microsoft 365 administrator suspects an attacker changed mailbox forwarding settings. It does not demonstrate the target outcome of The search estimate and results show which scoped content matches the test query. in the case described. This scenario concerns: An organization needs to locate items matching an investigation keyword across Microsoft 365 workloads.

This proposed result, “The case contains traceable scope, search criteria and preservation status.”, relates to A security analyst must preserve relevant mailbox content for legal investigation. It would not prove that Use an authorized Microsoft Purview eDiscovery content search with defined custodians and locations. met the current requirement. This scenario concerns: An organization needs to locate items matching an investigation keyword across Microsoft 365 workloads.

The option “Use an authorized Microsoft Purview eDiscovery content search with defined custodians and locations.” would address An organization needs to locate items matching an investigation keyword across Microsoft 365 workloads. It is less direct than Coordinate the scoped search and preservation workflow in the authorized eDiscovery case. for the case at hand. This scenario concerns: A security analyst must preserve relevant mailbox content for legal investigation.

“Limit eDiscovery content search to approved custodians and locations.” would prioritize A legal search should exclude personal mailboxes unrelated to the incident. That does not directly address the stated issue: A security analyst must preserve relevant mailbox content for legal investigation.

This alternative, “Apply least-privilege log access and restrict the query to the authorized app scope.”, is appropriate for A Graph audit query exposes tenant-wide data to an analyst who needs only one app. It does not establish the required outcome of The case contains traceable scope, search criteria and preservation status. This scenario concerns: A security analyst must preserve relevant mailbox content for legal investigation.

A search result excluding unrelated mailboxes shows good scope filtering. The authorized eDiscovery case must also retain the documented search criteria and preservation state for the material under hold.

“A second analyst can repeat the search and find the same control event.” tests A SOC manager wants a reproducible investigation of who altered a tenant policy. It does not demonstrate the target outcome of The case contains traceable scope, search criteria and preservation status. in the case described. This scenario concerns: A security analyst must preserve relevant mailbox content for legal investigation.

This proposed result, “The case identifies the app identity, request operation and observed timing.”, relates to An analyst suspects a malicious application queried Microsoft Graph with excessive privileges. It would not prove that Coordinate the scoped search and preservation workflow in the authorized eDiscovery case. met the current requirement. This scenario concerns: A security analyst must preserve relevant mailbox content for legal investigation.