Exam Bundle

A tighter KQL result set can exclude irrelevant matches but does not explain a discrepancy between source and reported item counts. Document the differing search scopes, filters or processing behavior behind the counts.

“The search estimate and results show which scoped content matches the test query.” tests An organization needs to locate items matching an investigation keyword across Microsoft 365 workloads. It does not demonstrate the target outcome of The analyst documents why the matched item counts differ. in the case described. This scenario concerns: An eDiscovery query has inconsistent results between two locations.

“The analyst retrieves the relevant app events without broad unrelated records.” may be appropriate evidence for A Graph audit query exposes tenant-wide data to an analyst who needs only one app., but the verification of the current incident must instead show The analyst documents why the matched item counts differ. This scenario concerns: An eDiscovery query has inconsistent results between two locations.

Coordinating preservation and scoped eDiscovery search protects legal evidence. The question asks for audit history of download and deletion operations on the same file identifiers, not merely search/hold administration.

“Search Purview Audit for matching file download operations and account activity.” would prioritize A SharePoint site owner reports a large number of downloaded documents overnight. That does not directly address the stated issue: A Microsoft 365 user deletes a SharePoint file after an anomalous download.

The proposed action “Search Microsoft Purview Audit for relevant mailbox and forwarding configuration events.” solves A Microsoft 365 administrator suspects an attacker changed mailbox forwarding settings. The present requirement is different: A Microsoft 365 user deletes a SharePoint file after an anomalous download.

This proposed result, “Audit records identify the actor, affected mailbox, action and timestamp.”, relates to A Microsoft 365 administrator suspects an attacker changed mailbox forwarding settings. It would not prove that Investigate relevant download and deletion audit events with the same file identifiers. met the current requirement. This scenario concerns: A Microsoft 365 user deletes a SharePoint file after an anomalous download.

“The timeline shows grant time followed by the relevant API operations.” may be appropriate evidence for A team wants to know whether an app permission grant preceded mass Graph API requests., but the verification of the current incident must instead show Records establish event ordering and the account responsible. This scenario concerns: A Microsoft 365 user deletes a SharePoint file after an anomalous download.

A content-search estimate reveals which items match the query, not who performed them or in what order. The requested audit reconstruction needs event timestamps, acting account and operation sequence.

“Find the relevant SharePoint or OneDrive sharing operations in Purview Audit.” would prioritize A file was shared anonymously from OneDrive during an insider-risk investigation. That does not directly address the stated issue: A SOC manager wants a reproducible investigation of who altered a tenant policy.

This alternative, “Investigate relevant download and deletion audit events with the same file identifiers.”, is appropriate for A Microsoft 365 user deletes a SharePoint file after an anomalous download. It does not establish the required outcome of A second analyst can repeat the search and find the same control event. This scenario concerns: A SOC manager wants a reproducible investigation of who altered a tenant policy.

The proposed action “Apply least-privilege log access and restrict the query to the authorized app scope.” solves A Graph audit query exposes tenant-wide data to an analyst who needs only one app. The present requirement is different: A SOC manager wants a reproducible investigation of who altered a tenant policy.

This proposed result, “The correlated history ties old and new filenames to the same document identity.”, relates to A respondent asks which account accessed a document but the file title changed. It would not prove that Save the approved Purview Audit search parameters and preserve exported event evidence. met the current requirement. This scenario concerns: A SOC manager wants a reproducible investigation of who altered a tenant policy.

“The case contains traceable scope, search criteria and preservation status.” may be appropriate evidence for A security analyst must preserve relevant mailbox content for legal investigation., but the verification of the current incident must instead show A second analyst can repeat the search and find the same control event. This scenario concerns: A SOC manager wants a reproducible investigation of who altered a tenant policy.

Retrieving authorized application events from logs confirms access to the right data. It does not establish that an independent analyst can reproduce the saved search and find the same controlled audit event.

This alternative, “Order Purview audit activity by event time and correlate related file operations.”, is appropriate for An analyst investigates a data export but wants the first event, not only the latest download. It does not establish the required outcome of The analyst retrieves the relevant app events without broad unrelated records. This scenario concerns: A Graph audit query exposes tenant-wide data to an analyst who needs only one app.

The option “Examine available Microsoft Graph activity logs for the application and API requests.” would address An analyst suspects a malicious application queried Microsoft Graph with excessive privileges. It is less direct than Apply least-privilege log access and restrict the query to the authorized app scope. for the case at hand. This scenario concerns: A Graph audit query exposes tenant-wide data to an analyst who needs only one app.

Searching mailbox and forwarding changes in Purview Audit investigates mail administration. The request concerns limiting access to app-activity logs and scoping queries to the authorized application.

“The timeline reveals when access began and how export volume grew.” may be appropriate evidence for An analyst investigates a data export but wants the first event, not only the latest download., but the verification of the current incident must instead show The analyst retrieves the relevant app events without broad unrelated records. This scenario concerns: A Graph audit query exposes tenant-wide data to an analyst who needs only one app.

An individual app request record can show principal, operation and time. The required access-control test must also demonstrate that only approved app events are returned without broad unrelated records.

“Audit records identify the actor, affected mailbox, action and timestamp.” tests A Microsoft 365 administrator suspects an attacker changed mailbox forwarding settings. It does not demonstrate the target outcome of The analyst retrieves the relevant app events without broad unrelated records. in the case described. This scenario concerns: A Graph audit query exposes tenant-wide data to an analyst who needs only one app.

The proposed action “Examine available Microsoft Graph activity logs for the application and API requests.” solves An analyst suspects a malicious application queried Microsoft Graph with excessive privileges. The present requirement is different: A suspected compromise involves email forwarding, file sharing and Graph application activity.

The option “Correlate Entra audit changes with Graph activity logs for the same service principal.” would address A team wants to know whether an app permission grant preceded mass Graph API requests. It is less direct than Build a cross-workload timeline from Purview Audit, eDiscovery metadata and Graph request logs. for the case at hand. This scenario concerns: A suspected compromise involves email forwarding, file sharing and Graph application activity.

“Query the supported Microsoft 365 audit events for group or Teams membership modifications.” would prioritize An analyst wants to investigate a suspicious Teams membership change. That does not directly address the stated issue: A suspected compromise involves email forwarding, file sharing and Graph application activity.

Attributing a Graph API request to its app identity supports one evidence stream. The final case must connect identity, mailbox settings, shared-file activity and the app sequence using source logs.

Linking app identity to a request burst supports an app-abuse finding. It does not reconstruct the mailbox and shared-file history needed for the multi-workload final case.

“The investigation counts affected files and ties them to the source user and session.” tests A SharePoint site owner reports a large number of downloaded documents overnight. It does not demonstrate the target outcome of The final case links identity, mail settings, shared files and app activity using source evidence. in the case described. This scenario concerns: A suspected compromise involves email forwarding, file sharing and Graph application activity.

The option “Use arg_max(Timestamp, *) by DeviceId after applying relevant filters.” would address A hunter needs the latest process event per device for incident triage. It is less direct than Start Advanced Hunting from the DeviceProcessEvents table and filter the relevant executable and command line. for the case at hand. This scenario concerns: A hunter needs process creation events associated with suspected credential dumping on endpoints.

“Add a KQL Timestamp filter using ago(1d) to the appropriate hunting query.” would prioritize A hunter needs events within the last 24 hours rather than the entire retention window. That does not directly address the stated issue: A hunter needs process creation events associated with suspected credential dumping on endpoints.

This alternative, “Rebuild graph edges using stable unique account identifiers.”, is appropriate for A hunting graph shows an apparent link between unrelated users with the same display name. It does not establish the required outcome of A seeded process creation record is returned with the correct device and process identifiers. This scenario concerns: A hunter needs process creation events associated with suspected credential dumping on endpoints.

Using arg_max to choose the latest process per device is a selection/ranking operation. It does not demonstrate that the seeded process creation row contains the correct device and process identifiers.

“The result includes the correct device metadata for the known process.” tests A process event needs enrichment from device identity metadata. It does not demonstrate the target outcome of A seeded process creation record is returned with the correct device and process identifiers. in the case described. This scenario concerns: A hunter needs process creation events associated with suspected credential dumping on endpoints.

This proposed result, “Events with missing hashes are handled explicitly rather than silently misclassified.”, relates to A hunter writes a query that assumes every event has a populated SHA256. It would not prove that Start Advanced Hunting from the DeviceProcessEvents table and filter the relevant executable and command line. met the current requirement. This scenario concerns: A hunter needs process creation events associated with suspected credential dumping on endpoints.