Exam Bundle

A search result excluding unrelated mailboxes shows good scope filtering. The authorized eDiscovery case must also retain the documented search criteria and preservation state for the material under hold.

“A second analyst can repeat the search and find the same control event.” tests A SOC manager wants a reproducible investigation of who altered a tenant policy. It does not demonstrate the target outcome of The case contains traceable scope, search criteria and preservation status. in the case described. This scenario concerns: A security analyst must preserve relevant mailbox content for legal investigation.

This proposed result, “The case identifies the app identity, request operation and observed timing.”, relates to An analyst suspects a malicious application queried Microsoft Graph with excessive privileges. It would not prove that Coordinate the scoped search and preservation workflow in the authorized eDiscovery case. met the current requirement. This scenario concerns: A security analyst must preserve relevant mailbox content for legal investigation.

Limiting eDiscovery to approved custodians and locations prevents unnecessary exposure. The specific issue also requires refining keywords and other search conditions so the output is selective instead of exporting everything.

This alternative, “Find the relevant SharePoint or OneDrive sharing operations in Purview Audit.”, is appropriate for A file was shared anonymously from OneDrive during an insider-risk investigation. It does not establish the required outcome of The revised query returns a narrower representative set without dropping seeded relevant items. This scenario concerns: An eDiscovery search returns too many unrelated files.

The proposed action “Filter Graph activity logs by application and resource operation to assess broad access.” solves An unusual Graph request targets mail or files across many users. The present requirement is different: An eDiscovery search returns too many unrelated files.

“The query identifies the affected resource set and abnormal request burst.” tests An unusual Graph request targets mail or files across many users. It does not demonstrate the target outcome of The revised query returns a narrower representative set without dropping seeded relevant items. in the case described. This scenario concerns: An eDiscovery search returns too many unrelated files.

This proposed result, “Records show the initiating user, file and sharing-link operation.”, relates to A file was shared anonymously from OneDrive during an insider-risk investigation. It would not prove that Refine supported search conditions, custodians and locations rather than exporting everything. met the current requirement. This scenario concerns: An eDiscovery search returns too many unrelated files.

“The search result set excludes unrelated mailbox locations.” may be appropriate evidence for A legal search should exclude personal mailboxes unrelated to the incident., but the verification of the current incident must instead show The revised query returns a narrower representative set without dropping seeded relevant items. This scenario concerns: An eDiscovery search returns too many unrelated files.

“Investigate relevant download and deletion audit events with the same file identifiers.” would prioritize A Microsoft 365 user deletes a SharePoint file after an anomalous download. That does not directly address the stated issue: A respondent asks which account accessed a document but the file title changed.

This alternative, “Limit eDiscovery content search to approved custodians and locations.”, is appropriate for A legal search should exclude personal mailboxes unrelated to the incident. It does not establish the required outcome of The correlated history ties old and new filenames to the same document identity. This scenario concerns: A respondent asks which account accessed a document but the file title changed.

The proposed action “Search Microsoft Purview Audit for relevant mailbox and forwarding configuration events.” solves A Microsoft 365 administrator suspects an attacker changed mailbox forwarding settings. The present requirement is different: A respondent asks which account accessed a document but the file title changed.

This proposed result, “The final case links identity, mail settings, shared files and app activity using source evidence.”, relates to A suspected compromise involves email forwarding, file sharing and Graph application activity. It would not prove that Search available audit events using stable identifiers, times and locations where possible. met the current requirement. This scenario concerns: A respondent asks which account accessed a document but the file title changed.

An app identity correlated to API request bursts helps investigate excessive Graph access. It does not establish that a renamed file is the same underlying document across old and new filenames.

An app-identity record showing operation and time characterizes the API request. It does not verify continuity of the document identity through a rename.

This alternative, “Build a cross-workload timeline from Purview Audit, eDiscovery metadata and Graph request logs.”, is appropriate for A suspected compromise involves email forwarding, file sharing and Graph application activity. It does not establish the required outcome of The case identifies the app identity, request operation and observed timing. This scenario concerns: An analyst suspects a malicious application queried Microsoft Graph with excessive privileges.

The proposed action “Search Microsoft Purview Audit for relevant mailbox and forwarding configuration events.” solves A Microsoft 365 administrator suspects an attacker changed mailbox forwarding settings. The present requirement is different: An analyst suspects a malicious application queried Microsoft Graph with excessive privileges.

Group-membership audit queries answer who changed Teams or directory membership. The present investigation requires Microsoft Graph request logs that identify the calling application and its actual API operations.

“The investigation matches app identity to the API request series.” may be appropriate evidence for A service principal triggers Graph calls but normal user sign-in logs have no record., but the verification of the current incident must instead show The case identifies the app identity, request operation and observed timing. This scenario concerns: An analyst suspects a malicious application queried Microsoft Graph with excessive privileges.

A cross-workload case can show several related security activities without proving which application identity issued an API call. The requested result needs the service principal, operation and time tied to that request.

A repeatable audit search proves another analyst can locate the event. It does not by itself attribute API requests to the application identity, operation and time; those fields must be shown in the case.

The proposed action “Order Purview audit activity by event time and correlate related file operations.” solves An analyst investigates a data export but wants the first event, not only the latest download. The present requirement is different: A service principal triggers Graph calls but normal user sign-in logs have no record.

The option “Build a cross-workload timeline from Purview Audit, eDiscovery metadata and Graph request logs.” would address A suspected compromise involves email forwarding, file sharing and Graph application activity. It is less direct than Correlate Graph activity data with workload identity and app registration context. for the case at hand. This scenario concerns: A service principal triggers Graph calls but normal user sign-in logs have no record.

“Correlate Entra audit changes with Graph activity logs for the same service principal.” would prioritize A team wants to know whether an app permission grant preceded mass Graph API requests. That does not directly address the stated issue: A service principal triggers Graph calls but normal user sign-in logs have no record.

Connecting mail, identity and file evidence into one case gives incident scope, but API attribution requires matching the application identity to the actual request series and its permission context.

A log entry naming an app, operation and timestamp is useful attribution. The required analysis must also correlate the app identity across the whole abnormal Graph request series.

This proposed result, “Records show the initiating user, file and sharing-link operation.”, relates to A file was shared anonymously from OneDrive during an insider-risk investigation. It would not prove that Correlate Graph activity data with workload identity and app registration context. met the current requirement. This scenario concerns: A service principal triggers Graph calls but normal user sign-in logs have no record.

The option “Examine available Microsoft Graph activity logs for the application and API requests.” would address An analyst suspects a malicious application queried Microsoft Graph with excessive privileges. It is less direct than Filter Graph activity logs by application and resource operation to assess broad access. for the case at hand. This scenario concerns: An unusual Graph request targets mail or files across many users.

Narrowing eDiscovery custodians and locations limits content collection. It does not filter Microsoft Graph activity logs by the application principal and resource operation associated with broad access.

“Correlate Purview audit records for inbox-rule changes with Defender email evidence.” would prioritize A suspicious inbox rule was created shortly after a user clicked a phishing email. That does not directly address the stated issue: An unusual Graph request targets mail or files across many users.

A narrower query retaining seeded relevant items demonstrates filtering accuracy. It does not alone identify the abnormal Graph request burst and the affected resource set across the selected app.

“Audit records identify the actor, affected mailbox, action and timestamp.” tests A Microsoft 365 administrator suspects an attacker changed mailbox forwarding settings. It does not demonstrate the target outcome of The query identifies the affected resource set and abnormal request burst. in the case described. This scenario concerns: An unusual Graph request targets mail or files across many users.

“The case identifies the app identity, request operation and observed timing.” may be appropriate evidence for An analyst suspects a malicious application queried Microsoft Graph with excessive privileges., but the verification of the current incident must instead show The query identifies the affected resource set and abnormal request burst. This scenario concerns: An unusual Graph request targets mail or files across many users.