Exam Bundle

Hourly login buckets test account-sign-in aggregation. They provide no evidence that a suspicious PowerShell command remains in the output while unrelated executable records are filtered out.

“The returned records identify destination IP, port and initiating process for the test device.” tests A hunter needs outbound network connections made by a suspicious executable. It does not demonstrate the target outcome of The test process matches while a benign unrelated executable is filtered out. in the case described. This scenario concerns: An analyst needs only suspicious PowerShell processes, not every executable.

This proposed result, “The file creation event shows its path, hash and relevant process context.”, relates to An analyst wants to find an executable written to disk by an unexpected parent process. It would not prove that Add a case-appropriate KQL where predicate on FileName or ProcessCommandLine. met the current requirement. This scenario concerns: An analyst needs only suspicious PowerShell processes, not every executable.

Adding parent-process and command-line constraints changes which events match. KQL project only controls which columns are returned; use projection when the requirement is the exact output schema, not narrower detection.

Normalizing columns and using union merges records from multiple source tables. It does not simply limit this report to DeviceName, Timestamp and FileName; KQL project directly chooses those three columns.

The proposed action “Account for nullable hash fields and test with representative records.” solves A hunter writes a query that assumes every event has a populated SHA256. The present requirement is different: A query must return just DeviceName, Timestamp and FileName for a report.

“Only the synthetic abnormal increase is flagged for review.” tests A query should identify a spike above an expected baseline, not merely all activity. It does not demonstrate the target outcome of The test output includes only the three requested fields. in the case described. This scenario concerns: A query must return just DeviceName, Timestamp and FileName for a report.

“The result includes the correct device metadata for the known process.” may be appropriate evidence for A process event needs enrichment from device identity metadata., but the verification of the current incident must instead show The test output includes only the three requested fields. This scenario concerns: A query must return just DeviceName, Timestamp and FileName for a report.

Restricting an event query to approved production assets and a time window limits which rows qualify. It does not ensure the resulting table contains only the three specified output fields.

“Construct a hunting graph from validated identity and device relationships.” would prioritize A SOC analyst needs a graph of user-to-device connections for blast-radius analysis. That does not directly address the stated issue: A hunt requires a calculated normalized account-name field.

The proposed action “Use mv-expand on the intended dynamic array before aggregation.” solves A query returns multiple entries because an array field is not expanded. The present requirement is different: A hunt requires a calculated normalized account-name field.

The option “Query EmailAttachmentInfo for the relevant email network message identifiers.” would address A hunt requires malware attachment hashes from suspicious messages. It is less direct than Use KQL extend to derive a new column without deleting the original. for the case at hand. This scenario concerns: A hunt requires a calculated normalized account-name field.

This proposed result, “The new controlled process event appears after the service is correctly configured.”, relates to An Advanced Hunting query returns no rows because endpoint telemetry was never onboarded. It would not prove that Use KQL extend to derive a new column without deleting the original. met the current requirement. This scenario concerns: A hunt requires a calculated normalized account-name field.

mv-expand splits elements in a dynamic array into separate rows. The request is to calculate a normalized account value while retaining the original account column, which requires an extend expression rather than array expansion.

An email attachment filename or hash demonstrates message-file enrichment, not that the hunting result includes both the original account identifier and its derived normalized value.

This alternative, “Query DeviceNetworkEvents with process and remote destination constraints in Defender XDR.”, is appropriate for A hunter needs outbound network connections made by a suspicious executable. It does not establish the required outcome of Output counts agree with a known synthetic event set for each device. This scenario concerns: A team wants counts of alerting processes by device over one day.

The proposed action “Aggregate by host and apply top 10 by event count descending.” solves A manager needs the 10 hosts with the highest suspicious-process counts. The present requirement is different: A team wants counts of alerting processes by device over one day.

Joining identity and cloud-app logs is useful for cross-source attribution. A device-count summary instead requires grouping the filtered event rows by DeviceName and calculating count(), not joining principals across tables.

arg_max returns the newest record for each device, discarding the earlier rows needed to calculate event counts. Device-level totals require summarize count() over the filtered period.

Verifying device metadata on one process record confirms attribution, not the number of alerting processes per device. The result needs aggregate counts checked against the seeded event set.

“The test graph shows only supported edges linking the compromised user to affected hosts.” tests A SOC analyst needs a graph of user-to-device connections for blast-radius analysis. It does not demonstrate the target outcome of Output counts agree with a known synthetic event set for each device. in the case described. This scenario concerns: A team wants counts of alerting processes by device over one day.

The proposed action “Join two Advanced Hunting tables on a validated device identifier and suitable time relation.” solves A process event needs enrichment from device identity metadata. The present requirement is different: A manager needs the 10 hosts with the highest suspicious-process counts.

DeviceRegistryEvents helps investigate startup persistence and registry modifications. It cannot rank the ten hosts with the highest suspicious-process counts without aggregating process events by host.

“Query DeviceNetworkEvents with process and remote destination constraints in Defender XDR.” would prioritize A hunter needs outbound network connections made by a suspicious executable. That does not directly address the stated issue: A manager needs the 10 hosts with the highest suspicious-process counts.

Confirming device metadata for one known process shows which endpoint generated that event. It does not prove that the returned hosts are the ten highest by total suspicious-process frequency.

“The known most recent record is chosen for each test device.” tests A hunter needs the latest process event per device for incident triage. It does not demonstrate the target outcome of Exactly the highest ranked known hosts are returned for the sample. in the case described. This scenario concerns: A manager needs the 10 hosts with the highest suspicious-process counts.

This proposed result, “An event older than one day is excluded while the recent test event remains.”, relates to A hunter needs events within the last 24 hours rather than the entire retention window. It would not prove that Aggregate by host and apply top 10 by event count descending. met the current requirement. This scenario concerns: A manager needs the 10 hosts with the highest suspicious-process counts.

The option “Add a KQL Timestamp filter using ago(1d) to the appropriate hunting query.” would address A hunter needs events within the last 24 hours rather than the entire retention window. It is less direct than Apply the KQL distinct operator to the relevant file hash column. for the case at hand. This scenario concerns: A hunter needs one row per distinct SHA256 value after filtering malware evidence.

Handling null hashes avoids treating missing values as real file identifiers. It does not remove repeated non-null SHA256 values from the output; the distinct operator is needed for one row per hash.

“Use arg_max(Timestamp, *) by DeviceId after applying relevant filters.” would prioritize A hunter needs the latest process event per device for incident triage. That does not directly address the stated issue: A hunter needs one row per distinct SHA256 value after filtering malware evidence.

“Events with missing hashes are handled explicitly rather than silently misclassified.” tests A hunter writes a query that assumes every event has a populated SHA256. It does not demonstrate the target outcome of Duplicate sample hashes collapse to one result row. in the case described. This scenario concerns: A hunter needs one row per distinct SHA256 value after filtering malware evidence.

This proposed result, “The known most recent record is chosen for each test device.”, relates to A hunter needs the latest process event per device for incident triage. It would not prove that Apply the KQL distinct operator to the relevant file hash column. met the current requirement. This scenario concerns: A hunter needs one row per distinct SHA256 value after filtering malware evidence.

“A short table distinguishes observed indicators from unconfirmed hypotheses.” may be appropriate evidence for An analyst needs to compare observed tactics against a current threat analytics advisory., but the verification of the current incident must instead show Duplicate sample hashes collapse to one result row. This scenario concerns: A hunter needs one row per distinct SHA256 value after filtering malware evidence.