Exam Bundle

Flagging a synthetic spike validates anomaly detection. A reusable saved hunt instead needs a second authorized analyst to open the documented query and reproduce the same seeded result.

“The test process maps to its associated outbound connection.” tests A hunter wants evidence whether a suspicious process reached an external IP. It does not demonstrate the target outcome of A second analyst can rerun it and retrieve the seeded sample. in the case described. This scenario concerns: A hunter wants to reuse a query regularly across investigations.

“Events with missing hashes are handled explicitly rather than silently misclassified.” may be appropriate evidence for A hunter writes a query that assumes every event has a populated SHA256., but the verification of the current incident must instead show A second analyst can rerun it and retrieve the seeded sample. This scenario concerns: A hunter wants to reuse a query regularly across investigations.

“Join two Advanced Hunting tables on a validated device identifier and suitable time relation.” would prioritize A process event needs enrichment from device identity metadata. That does not directly address the stated issue: A SOC analyst needs a graph of user-to-device connections for blast-radius analysis.

This alternative, “Compare current summarized counts to a documented historic baseline and threshold.”, is appropriate for A query should identify a spike above an expected baseline, not merely all activity. It does not establish the required outcome of The test graph shows only supported edges linking the compromised user to affected hosts. This scenario concerns: A SOC analyst needs a graph of user-to-device connections for blast-radius analysis.

The proposed action “Use summarize by account and bin(Timestamp, 1h) to create hourly counts.” solves An analyst needs a baseline for the number of logons per user per hour. The present requirement is different: A SOC analyst needs a graph of user-to-device connections for blast-radius analysis.

“The output separates known login events into their correct hourly buckets.” tests An analyst needs a baseline for the number of logons per user per hour. It does not demonstrate the target outcome of The test graph shows only supported edges linking the compromised user to affected hosts. in the case described. This scenario concerns: A SOC analyst needs a graph of user-to-device connections for blast-radius analysis.

Unverified graph edges cannot establish a defensible blast-radius analysis.

One process event with correct device identifiers supports execution attribution, but it does not establish a set of validated user-to-device edges for a blast-radius hunting graph.

This alternative, “Join two Advanced Hunting tables on a validated device identifier and suitable time relation.”, is appropriate for A process event needs enrichment from device identity metadata. It does not establish the required outcome of Both known users connect to the test server node with distinct edges. This scenario concerns: An investigator needs to see whether two identities accessed the same server.

The proposed action “Explore supported Sentinel Graph entity relationships with the relevant incident identifiers.” solves A responder needs Sentinel Graph context for entities connected through alerts. The present requirement is different: An investigator needs to see whether two identities accessed the same server.

The option “Use KQL extend to derive a new column without deleting the original.” would address A hunt requires a calculated normalized account-name field. It is less direct than Use a hunting graph or validated identity-device relationships from the available telemetry. for the case at hand. This scenario concerns: An investigator needs to see whether two identities accessed the same server.

This proposed result, “Exactly the highest ranked known hosts are returned for the sample.”, relates to A manager needs the 10 hosts with the highest suspicious-process counts. It would not prove that Use a hunting graph or validated identity-device relationships from the available telemetry. met the current requirement. This scenario concerns: An investigator needs to see whether two identities accessed the same server.

“The result includes the correct device metadata for the known process.” may be appropriate evidence for A process event needs enrichment from device identity metadata., but the verification of the current incident must instead show Both known users connect to the test server node with distinct edges. This scenario concerns: An investigator needs to see whether two identities accessed the same server.

Hourly account-login counts show authentication frequency, not the individual relationships connecting two specific users to a shared server node in the investigation graph.

The proposed action “Construct a hunting graph from validated identity and device relationships.” solves A SOC analyst needs a graph of user-to-device connections for blast-radius analysis. The present requirement is different: An incident involves multiple devices and a shared malicious file hash.

The option “Align Advanced Hunting table and device scope with the threat analytics campaign profile.” would address A report says a malicious family targets browsers, but the hunt checks only servers. It is less direct than Analyze file/device relationships in a graph or correlated Advanced Hunting results. for the case at hand. This scenario concerns: An incident involves multiple devices and a shared malicious file hash.

Registry startup evidence helps trace persistence on a host. The incident question requires determining which devices share the same malicious file hash, using file-device relations rather than startup keys.

“Records from similarly named devices are no longer incorrectly combined.” may be appropriate evidence for A process hunt groups events by only a display hostname shared across assets., but the verification of the current incident must instead show The case identifies all devices with confirmed observations of the hash. This scenario concerns: An incident involves multiple devices and a shared malicious file hash.

A registry change with process and timestamp documents a persistence modification on one device. It does not identify every device where the malicious file hash was actually observed.

“The known most recent record is chosen for each test device.” tests A hunter needs the latest process event per device for incident triage. It does not demonstrate the target outcome of The case identifies all devices with confirmed observations of the hash. in the case described. This scenario concerns: An incident involves multiple devices and a shared malicious file hash.

The proposed action “Use KQL extend to derive a new column without deleting the original.” solves A hunt requires a calculated normalized account-name field. The present requirement is different: A hunting graph shows an apparent link between unrelated users with the same display name.

The option “Group by stable device identifiers and retain the display name as metadata.” would address A process hunt groups events by only a display hostname shared across assets. It is less direct than Rebuild graph edges using stable unique account identifiers. for the case at hand. This scenario concerns: A hunting graph shows an apparent link between unrelated users with the same display name.

“Explore supported Sentinel Graph entity relationships with the relevant incident identifiers.” would prioritize A responder needs Sentinel Graph context for entities connected through alerts. That does not directly address the stated issue: A hunting graph shows an apparent link between unrelated users with the same display name.

A graph can contain only telemetry-supported edges and still collapse separate accounts that share a display name. This defect requires rebuilding relationships from immutable account identifiers.

Showing seeded account, endpoint and network relationships does not prove two same-named but distinct identities remain separate. Identity disambiguation must be tested with their unique account IDs.

This proposed result, “Output counts agree with a known synthetic event set for each device.”, relates to A team wants counts of alerting processes by device over one day. It would not prove that Rebuild graph edges using stable unique account identifiers. met the current requirement. This scenario concerns: A hunting graph shows an apparent link between unrelated users with the same display name.

The option “Rebuild graph edges using stable unique account identifiers.” would address A hunting graph shows an apparent link between unrelated users with the same display name. It is less direct than Explore supported Sentinel Graph entity relationships with the relevant incident identifiers. for the case at hand. This scenario concerns: A responder needs Sentinel Graph context for entities connected through alerts.

mv-expand decomposes a dynamic array in query output. It does not traverse incident-linked Sentinel Graph entity relationships or explain how alerts connect accounts, endpoints and network nodes.

This alternative, “Construct a hunting graph from validated identity and device relationships.”, is appropriate for A SOC analyst needs a graph of user-to-device connections for blast-radius analysis. It does not establish the required outcome of The graph reveals the seeded account, endpoint and network edges without inventing links. This scenario concerns: A responder needs Sentinel Graph context for entities connected through alerts.

A test graph linking one compromised user to affected hosts validates a different blast-radius view. This test needs the alert-associated Sentinel Graph context, including seeded account, endpoint and network relationships without unsupported edges.

This proposed result, “The returned records identify destination IP, port and initiating process for the test device.”, relates to A hunter needs outbound network connections made by a suspicious executable. It would not prove that Explore supported Sentinel Graph entity relationships with the relevant incident identifiers. met the current requirement. This scenario concerns: A responder needs Sentinel Graph context for entities connected through alerts.

“The search finds the seeded email's delivery and threat-verdict metadata.” may be appropriate evidence for A phishing investigation needs matching inbound email delivery events., but the verification of the current incident must instead show The graph reveals the seeded account, endpoint and network edges without inventing links. This scenario concerns: A responder needs Sentinel Graph context for entities connected through alerts.