Exam Bundle

An endpoint network-event query can identify a process, destination IP and port. It cannot establish which phishing email contained the malicious URL or which recipient received that message; that requires joining URL evidence to the corresponding email record.

This proposed result, “The file creation event shows its path, hash and relevant process context.”, relates to An analyst wants to find an executable written to disk by an unexpected parent process. It would not prove that Query EmailUrlInfo and join the relevant message identifier to EmailEvents. met the current requirement. This scenario concerns: An analyst wants to inspect URLs embedded in known phishing messages.

“The test process maps to its associated outbound connection.” may be appropriate evidence for A hunter wants evidence whether a suspicious process reached an external IP., but the verification of the current incident must instead show The result pairs the malicious URL with its source email and recipient. This scenario concerns: An analyst wants to inspect URLs embedded in known phishing messages.

KQL extend adds a calculated column to records already in the query. It does not retrieve attachment rows or file hashes from EmailAttachmentInfo, which is the evidence the malware-attachment hunt needs.

This alternative, “Query EmailUrlInfo and join the relevant message identifier to EmailEvents.”, is appropriate for An analyst wants to inspect URLs embedded in known phishing messages. It does not establish the required outcome of The attachment row includes the expected file name or SHA256 hash. This scenario concerns: A hunt requires malware attachment hashes from suspicious messages.

The proposed action “Rebuild graph edges using stable unique account identifiers.” solves A hunting graph shows an apparent link between unrelated users with the same display name. The present requirement is different: A hunt requires malware attachment hashes from suspicious messages.

This proposed result, “The test process matches while a benign unrelated executable is filtered out.”, relates to An analyst needs only suspicious PowerShell processes, not every executable. It would not prove that Query EmailAttachmentInfo for the relevant email network message identifiers. met the current requirement. This scenario concerns: A hunt requires malware attachment hashes from suspicious messages.

“A controlled DLL-associated event is present in the correct dataset.” may be appropriate evidence for A hunt for suspicious DLL execution accidentally uses only process creation records., but the verification of the current incident must instead show The attachment row includes the expected file name or SHA256 hash. This scenario concerns: A hunt requires malware attachment hashes from suspicious messages.

Showing an original and normalized account field tests an identity transformation. It does not show that the queried email attachment has the expected filename or SHA256 hash.

This alternative, “Verify table availability and relevant Defender workload onboarding before altering KQL.”, is appropriate for An Advanced Hunting query returns no rows because endpoint telemetry was never onboarded. It does not establish the required outcome of Matching account attempts and results appear in the hunter's output. This scenario concerns: A researcher needs authentication activity for a potential password spray from one source IP.

The proposed action “Apply the KQL distinct operator to the relevant file hash column.” solves A hunter needs one row per distinct SHA256 value after filtering malware evidence. The present requirement is different: A researcher needs authentication activity for a potential password spray from one source IP.

The option “Use a hunting graph or validated identity-device relationships from the available telemetry.” would address An investigator needs to see whether two identities accessed the same server. It is less direct than Select supported identity logon telemetry such as IdentityLogonEvents and filter the source context. for the case at hand. This scenario concerns: A researcher needs authentication activity for a potential password spray from one source IP.

This proposed result, “Duplicate sample hashes collapse to one result row.”, relates to A hunter needs one row per distinct SHA256 value after filtering malware evidence. It would not prove that Select supported identity logon telemetry such as IdentityLogonEvents and filter the source context. met the current requirement. This scenario concerns: A researcher needs authentication activity for a potential password spray from one source IP.

“An event older than one day is excluded while the recent test event remains.” may be appropriate evidence for A hunter needs events within the last 24 hours rather than the entire retention window., but the verification of the current incident must instead show Matching account attempts and results appear in the hunter's output. This scenario concerns: A researcher needs authentication activity for a potential password spray from one source IP.

Email delivery and verdict metadata describe message processing, not the sign-in attempt, account and authentication result under investigation. Identity logon telemetry must support those conclusions.

This alternative, “Correlate DeviceProcessEvents and DeviceNetworkEvents with process identifiers and time.”, is appropriate for A hunter wants evidence whether a suspicious process reached an external IP. It does not establish the required outcome of Query results link the test sign-in to the intended user and app rather than coincidental names. This scenario concerns: A SOC wants to identify risky cloud app sign-ins tied to a device.

The proposed action “Construct a hunting graph from validated identity and device relationships.” solves A SOC analyst needs a graph of user-to-device connections for blast-radius analysis. The present requirement is different: A SOC wants to identify risky cloud app sign-ins tied to a device.

Filtering process command lines is useful for endpoint execution hunts. Risky cloud application sign-ins require correlation of identity, app and device events, rather than string-matching process launch parameters.

“The search finds the seeded email's delivery and threat-verdict metadata.” may be appropriate evidence for A phishing investigation needs matching inbound email delivery events., but the verification of the current incident must instead show Query results link the test sign-in to the intended user and app rather than coincidental names. This scenario concerns: A SOC wants to identify risky cloud app sign-ins tied to a device.

Per-device event counts verify aggregation totals, but cannot prove that a specific cloud sign-in belongs to the intended account and app. The test must join the sign-in to stable user, application and device identifiers.

A graph connecting a compromised user to affected hosts can support blast-radius analysis, but does not by itself prove that the tested cloud-app authentication event is associated with the right user and application.

The proposed action “Query DeviceNetworkEvents with process and remote destination constraints in Defender XDR.” solves A hunter needs outbound network connections made by a suspicious executable. The present requirement is different: A hunter needs events within the last 24 hours rather than the entire retention window.

The option “Start Advanced Hunting from the DeviceProcessEvents table and filter the relevant executable and command line.” would address A hunter needs process creation events associated with suspected credential dumping on endpoints. It is less direct than Add a KQL Timestamp filter using ago(1d) to the appropriate hunting query. for the case at hand. This scenario concerns: A hunter needs events within the last 24 hours rather than the entire retention window.

“Use arg_max(Timestamp, *) by DeviceId after applying relevant filters.” would prioritize A hunter needs the latest process event per device for incident triage. That does not directly address the stated issue: A hunter needs events within the last 24 hours rather than the entire retention window.

A matching process event establishes that the correct device and process identifiers are present. Without a Timestamp cutoff it may include older records, so it does not verify the last-24-hours filter.

Selecting the most recent event per device using arg_max is a ranking operation. It does not exclude all events older than one day from the hunting window, which requires an explicit time predicate.

“The hunter identifies the campaign indicators and applicable telemetry sources.” tests A researcher wants to prioritize threats described in Defender XDR threat analytics. It does not demonstrate the target outcome of An event older than one day is excluded while the recent test event remains. in the case described. This scenario concerns: A hunter needs events within the last 24 hours rather than the entire retention window.

Ranking hosts by event count summarizes activity after selection; it does not restrict the underlying process events to suspicious PowerShell launches. A FileName or command-line filter is needed before aggregation.

“Select supported identity logon telemetry such as IdentityLogonEvents and filter the source context.” would prioritize A researcher needs authentication activity for a potential password spray from one source IP. That does not directly address the stated issue: An analyst needs only suspicious PowerShell processes, not every executable.

This alternative, “Query DeviceNetworkEvents with process and remote destination constraints in Defender XDR.”, is appropriate for A hunter needs outbound network connections made by a suspicious executable. It does not establish the required outcome of The test process matches while a benign unrelated executable is filtered out. This scenario concerns: An analyst needs only suspicious PowerShell processes, not every executable.

Hourly login buckets test account-sign-in aggregation. They provide no evidence that a suspicious PowerShell command remains in the output while unrelated executable records are filtered out.

“The returned records identify destination IP, port and initiating process for the test device.” tests A hunter needs outbound network connections made by a suspicious executable. It does not demonstrate the target outcome of The test process matches while a benign unrelated executable is filtered out. in the case described. This scenario concerns: An analyst needs only suspicious PowerShell processes, not every executable.

This proposed result, “The file creation event shows its path, hash and relevant process context.”, relates to An analyst wants to find an executable written to disk by an unexpected parent process. It would not prove that Add a case-appropriate KQL where predicate on FileName or ProcessCommandLine. met the current requirement. This scenario concerns: An analyst needs only suspicious PowerShell processes, not every executable.