Exam Bundle

A notebook reconstructing graph relationships shows analysis functionality. The access test is narrower: a permitted test cell must read only the authorized hunting resource without disclosing unrelated datasets or credentials.

“An authorized test cell can read a known event without exposing secrets.” tests A Python notebook cannot authenticate to Sentinel data sources. It does not demonstrate the target outcome of A sanctioned notebook request retrieves only the authorized hunting resource. in the case described. This scenario concerns: A notebook needs context from the supported Sentinel MCP Server for a hunting workflow.

This proposed result, “Benign backup activity is excluded while the suspicious sign-in sample remains.”, relates to A hunting query is noisy because it includes expected backup-service authentications. It would not prove that Establish the documented MCP connection and permission boundary before invoking tools. met the current requirement. This scenario concerns: A notebook needs context from the supported Sentinel MCP Server for a hunting workflow.

“Create a Microsoft Sentinel hunting query with appropriate KQL and a defined data source.” would prioritize A hunter wants an ad-hoc Sentinel query for suspicious sign-in activity and may save it for reuse. That does not directly address the stated issue: The team wants to separate a summary rule from a KQL data-lake job.

This alternative, “Verify Sentinel data-lake onboarding and the analyst's job permissions.”, is appropriate for A data lake KQL job fails because the workspace was not onboarded to the required capability. It does not establish the required outcome of The test workflows demonstrate the distinct summary output and job result. This scenario concerns: The team wants to separate a summary rule from a KQL data-lake job.

The proposed action “Use a supported Microsoft Sentinel data-lake KQL job with the required joins.” solves A SOC wants to detect historical attacks by joining two years of data-lake logs. The present requirement is different: The team wants to separate a summary rule from a KQL data-lake job.

“A sanctioned notebook request retrieves only the authorized hunting resource.” tests A notebook needs context from the supported Sentinel MCP Server for a hunting workflow. It does not demonstrate the target outcome of The test workflows demonstrate the distinct summary output and job result. in the case described. This scenario concerns: The team wants to separate a summary rule from a KQL data-lake job.

“The asynchronous result includes the seeded cross-table historical match.” may be appropriate evidence for A SOC wants to detect historical attacks by joining two years of data-lake logs., but the verification of the current incident must instead show The test workflows demonstrate the distinct summary output and job result. This scenario concerns: The team wants to separate a summary rule from a KQL data-lake job.

An authorized data-lake job can run without proving the separate summary-rule pipeline wrote its aggregates. The requested comparison needs both scheduled summary output and the asynchronous job result.

This alternative, “Evaluate a supported search job for that archived table and its retrieval requirements.”, is appropriate for An analyst requires a one-off investigation of archived single-table logs prior to data-lake onboarding. It does not establish the required outcome of The seeded two-table relationship appears in the asynchronous result. This scenario concerns: A query uses join across multiple historical tables but the analyst chose a single-table search job.

The proposed action “Execute a supported asynchronous data-lake KQL job rather than broad permanent ingestion.” solves A team wants a one-time historical investigation without turning all old data into hot analytics logs. The present requirement is different: A query uses join across multiple historical tables but the analyst chose a single-table search job.

A single-table query does not satisfy the required multitable join across historical data.

This proposed result, “The hydrated test events appear in the specified search results table.”, relates to An analyst requires a one-off investigation of archived single-table logs prior to data-lake onboarding. It would not prove that Select a data-lake KQL job that supports the required multitable joins. met the current requirement. This scenario concerns: A query uses join across multiple historical tables but the analyst chose a single-table search job.

The case requires a historical relationship between tables. A single-table result does not demonstrate the required two-table correlation in the data-lake KQL job.

Indicator matching shows IOC provenance in network telemetry. It does not demonstrate the asynchronous KQL job joined the two seeded historical tables correctly.

This alternative, “Use a supported Sentinel notebook with the required data connection and graph analysis libraries.”, is appropriate for A notebook analyst wants to perform a complex graph-style hunt over incident entities. It does not establish the required outcome of The hydrated test events appear in the specified search results table. This scenario concerns: An analyst requires a one-off investigation of archived single-table logs prior to data-lake onboarding.

The proposed action “Execute a supported asynchronous data-lake KQL job rather than broad permanent ingestion.” solves A team wants a one-time historical investigation without turning all old data into hot analytics logs. The present requirement is different: An analyst requires a one-off investigation of archived single-table logs prior to data-lake onboarding.

A multi-table data-lake KQL job supports complex historical joins after the required data-lake setup. This is a one-off retrieval of archived records from a single table, for which a supported search job is the appropriate starting point.

“The validation record documents recall, noise and required scheduling changes.” may be appropriate evidence for A team wants to monitor saved hunting queries that may become operational detections., but the verification of the current incident must instead show The hydrated test events appear in the specified search results table. This scenario concerns: An analyst requires a one-off investigation of archived single-table logs prior to data-lake onboarding.

A cross-table match in an asynchronous job proves historical join logic, not that the requested single-table archived records were hydrated into the approved search-results table.

Documenting that a historical job ran and which tables it consulted does not prove the specified archived events are present in the search-results destination for inspection.

The proposed action “Schedule or manage the supported query workflow and monitor its run results.” solves A SOC wants the same hunting query evaluated regularly for newly suspicious hosts. The present requirement is different: A SOC is hunting for a user who suddenly downloaded an unusual number of files.

The option “Join or correlate current IOC data with the appropriate Sentinel network telemetry.” would address A hunter asks for all events with malicious IPs from a threat intelligence table. It is less direct than Create a KQL baseline of typical counts and compare with current activity. for the case at hand. This scenario concerns: A SOC is hunting for a user who suddenly downloaded an unusual number of files.

“Add a narrow documented exclusion or baseline condition rather than discard the hunt.” would prioritize A hunting query is noisy because it includes expected backup-service authentications. That does not directly address the stated issue: A SOC is hunting for a user who suddenly downloaded an unusual number of files.

A hunting-query execution schedule and test-host evidence show cadence and coverage, not that a baseline comparison identifies the deliberately high-volume user without flagging normal controls.

“An authorized test cell can read a known event without exposing secrets.” tests A Python notebook cannot authenticate to Sentinel data sources. It does not demonstrate the target outcome of The synthetic high-volume user is flagged without marking normal users. in the case described. This scenario concerns: A SOC is hunting for a user who suddenly downloaded an unusual number of files.

This proposed result, “Benign backup activity is excluded while the suspicious sign-in sample remains.”, relates to A hunting query is noisy because it includes expected backup-service authentications. It would not prove that Create a KQL baseline of typical counts and compare with current activity. met the current requirement. This scenario concerns: A SOC is hunting for a user who suddenly downloaded an unusual number of files.

Updating a saved hunt's table and column names repairs schema compatibility. It does not produce a per-account, per-window summary of known versus unusual sign-in countries.

“Create a Sentinel hunting bookmark from the query result with the correct entities and notes.” would prioritize An analyst wants to bookmark an unusual logon event for later case-building. That does not directly address the stated issue: An investigator must compare sign-ins from known and unusual locations.

This alternative, “Create a Microsoft Sentinel hunting query with appropriate KQL and a defined data source.”, is appropriate for A hunter wants an ad-hoc Sentinel query for suspicious sign-in activity and may save it for reuse. It does not establish the required outcome of The test account with unexpected location diversity stands out from stable controls. This scenario concerns: An investigator must compare sign-ins from known and unusual locations.

A synthetic high-volume user test measures download or sign-in count anomalies. It does not establish that the query distinguishes unexpected geographic diversity from stable-location accounts.

“The hydrated test events appear in the specified search results table.” tests An analyst requires a one-off investigation of archived single-table logs prior to data-lake onboarding. It does not demonstrate the target outcome of The test account with unexpected location diversity stands out from stable controls. in the case described. This scenario concerns: An investigator must compare sign-ins from known and unusual locations.

“The bookmarked test event remains available for investigation with its associated entity context.” may be appropriate evidence for An analyst wants to bookmark an unusual logon event for later case-building., but the verification of the current incident must instead show The test account with unexpected location diversity stands out from stable controls. This scenario concerns: An investigator must compare sign-ins from known and unusual locations.