Exam Bundle

A narrower query retaining seeded relevant items demonstrates filtering accuracy. It does not alone identify the abnormal Graph request burst and the affected resource set across the selected app.

“Audit records identify the actor, affected mailbox, action and timestamp.” tests A Microsoft 365 administrator suspects an attacker changed mailbox forwarding settings. It does not demonstrate the target outcome of The query identifies the affected resource set and abnormal request burst. in the case described. This scenario concerns: An unusual Graph request targets mail or files across many users.

“The case identifies the app identity, request operation and observed timing.” may be appropriate evidence for An analyst suspects a malicious application queried Microsoft Graph with excessive privileges., but the verification of the current incident must instead show The query identifies the affected resource set and abnormal request burst. This scenario concerns: An unusual Graph request targets mail or files across many users.

“Order Purview audit activity by event time and correlate related file operations.” would prioritize An analyst investigates a data export but wants the first event, not only the latest download. That does not directly address the stated issue: A team wants to know whether an app permission grant preceded mass Graph API requests.

This alternative, “Examine available Microsoft Graph activity logs for the application and API requests.”, is appropriate for An analyst suspects a malicious application queried Microsoft Graph with excessive privileges. It does not establish the required outcome of The timeline shows grant time followed by the relevant API operations. This scenario concerns: A team wants to know whether an app permission grant preceded mass Graph API requests.

The proposed action “Build a cross-workload timeline from Purview Audit, eDiscovery metadata and Graph request logs.” solves A suspected compromise involves email forwarding, file sharing and Graph application activity. The present requirement is different: A team wants to know whether an app permission grant preceded mass Graph API requests.

“The timeline reveals when access began and how export volume grew.” tests An analyst investigates a data export but wants the first event, not only the latest download. It does not demonstrate the target outcome of The timeline shows grant time followed by the relevant API operations. in the case described. This scenario concerns: A team wants to know whether an app permission grant preceded mass Graph API requests.

This proposed result, “The analyst retrieves the relevant app events without broad unrelated records.”, relates to A Graph audit query exposes tenant-wide data to an analyst who needs only one app. It would not prove that Correlate Entra audit changes with Graph activity logs for the same service principal. met the current requirement. This scenario concerns: A team wants to know whether an app permission grant preceded mass Graph API requests.

“The returned record identifies the target group and initiating account.” may be appropriate evidence for An analyst wants to investigate a suspicious Teams membership change., but the verification of the current incident must instead show The timeline shows grant time followed by the relevant API operations. This scenario concerns: A team wants to know whether an app permission grant preceded mass Graph API requests.

This alternative, “Search Microsoft Purview Audit for relevant mailbox and forwarding configuration events.”, is appropriate for A Microsoft 365 administrator suspects an attacker changed mailbox forwarding settings. It does not establish the required outcome of The audit case documents the account, assigned role and suspicious operations. This scenario concerns: Purview Audit searches show operations by an unfamiliar admin account.

The proposed action “Search available audit events using stable identifiers, times and locations where possible.” solves A respondent asks which account accessed a document but the file title changed. The present requirement is different: Purview Audit searches show operations by an unfamiliar admin account.

The option “Verify audit availability, retention and search range before concluding the activity never happened.” would address A privileged administrator says no audit records exist for a suspicious change. It is less direct than Validate the principal identity against Entra sign-in and role information. for the case at hand. This scenario concerns: Purview Audit searches show operations by an unfamiliar admin account.

“A test control action is retrievable under the corrected scope or a documented gap is identified.” may be appropriate evidence for A privileged administrator says no audit records exist for a suspicious change., but the verification of the current incident must instead show The audit case documents the account, assigned role and suspicious operations. This scenario concerns: Purview Audit searches show operations by an unfamiliar admin account.

A resource-burst query identifies unusual request volume and target assets. The requested audit must establish which account held the role and what privileged operations it performed, not only how busy a resource was.

Document identity correlation can connect renamed files to one object. The current audit is about privileged account activity, so it needs the acting account, assigned role and suspicious operations rather than document lineage.

This alternative, “Apply least-privilege log access and restrict the query to the authorized app scope.”, is appropriate for A Graph audit query exposes tenant-wide data to an analyst who needs only one app. It does not establish the required outcome of The timeline reveals when access began and how export volume grew. This scenario concerns: An analyst investigates a data export but wants the first event, not only the latest download.

The proposed action “Coordinate the scoped search and preservation workflow in the authorized eDiscovery case.” solves A security analyst must preserve relevant mailbox content for legal investigation. The present requirement is different: An analyst investigates a data export but wants the first event, not only the latest download.

Membership-change audit events reveal group or Teams assignments. Sequencing file operations calls for Purview content-access and modification audit events ordered by timestamp and joined to the affected objects.

Retrieving relevant app events under a narrow scope tests access and filtering. The case also needs to show when those requests began and how the export rate grew over time.

A group-change audit entry identifies a target group and actor. It does not quantify the app's data export volume or order the access events into the case timeline.

“The timeline shows grant time followed by the relevant API operations.” tests A team wants to know whether an app permission grant preceded mass Graph API requests. It does not demonstrate the target outcome of The timeline reveals when access began and how export volume grew. in the case described. This scenario concerns: An analyst investigates a data export but wants the first event, not only the latest download.

Selecting every tenant mailbox broadens the search beyond the incident's approved custodians. Restrict case data sources to the authorized mailbox locations before running a query.

A cross-workload timeline combines Audit, eDiscovery and Graph evidence. The immediate boundary is a supported eDiscovery content search limited to the authorized custodians and locations.

Keyword filters narrow matching items but do not remove unrelated mailboxes from the set of searchable locations. Explicitly exclude unapproved mailbox data sources from the case search.

Reconciling search item counts explains differences between result estimates and matches. The requirement here is a properly scoped eDiscovery search that excludes unrelated mailbox locations.

A case with preserved criteria and status is auditable, but it may still include out-of-scope mailboxes. The test must inspect the returned locations and verify unrelated custodians were excluded.

This proposed result, “The revised query returns a narrower representative set without dropping seeded relevant items.”, relates to An eDiscovery search returns too many unrelated files. It would not prove that Limit eDiscovery content search to approved custodians and locations. met the current requirement. This scenario concerns: A legal search should exclude personal mailboxes unrelated to the incident.

The option “Apply least-privilege log access and restrict the query to the authorized app scope.” would address A Graph audit query exposes tenant-wide data to an analyst who needs only one app. It is less direct than Verify workload support, indexing status and search conditions separately for each source. for the case at hand. This scenario concerns: An eDiscovery query has inconsistent results between two locations.

“Refine supported search conditions, custodians and locations rather than exporting everything.” would prioritize An eDiscovery search returns too many unrelated files. That does not directly address the stated issue: An eDiscovery query has inconsistent results between two locations.

This alternative, “Correlate Graph activity data with workload identity and app registration context.”, is appropriate for A service principal triggers Graph calls but normal user sign-in logs have no record. It does not establish the required outcome of The analyst documents why the matched item counts differ. This scenario concerns: An eDiscovery query has inconsistent results between two locations.

A tighter KQL result set can exclude irrelevant matches but does not explain a discrepancy between source and reported item counts. Document the differing search scopes, filters or processing behavior behind the counts.

“The search estimate and results show which scoped content matches the test query.” tests An organization needs to locate items matching an investigation keyword across Microsoft 365 workloads. It does not demonstrate the target outcome of The analyst documents why the matched item counts differ. in the case described. This scenario concerns: An eDiscovery query has inconsistent results between two locations.

“The analyst retrieves the relevant app events without broad unrelated records.” may be appropriate evidence for A Graph audit query exposes tenant-wide data to an analyst who needs only one app., but the verification of the current incident must instead show The analyst documents why the matched item counts differ. This scenario concerns: An eDiscovery query has inconsistent results between two locations.