Question 540 A legacy app is replaced by a new enterprise application, and the existing CA policy no longer triggers. What must be verified? That the previous application's display name is reused That the new application ID is included in the intended CA app scope That the user's MFA method was deleted during migration Retain the old enterprise application ID in CA targeting and assume that the replacement application inherits the same policy scope Explanation Correct Answer B:A successor service principal may require explicit targeting. Incorrect Answers A:Matching names do not ensure identical identity objects. C:Deleting methods cannot retarget policies. D:Different app registrations have distinct identifiers; the replacement must be included in the intended cloud-app selection.
Question 541 An analyst sees email delivery, endpoint execution and identity sign-in alerts grouped into one incident. What should they investigate first? The correlated incident timeline and related entities across workloads Only the device health page with no incident relationship Review the tenant's current high-level Secure Score controls instead of opening the incident's correlated email, identity and endpoint timeline Base the incident narrative solely on the initial phishing alert, omitting the subsequent user sign-in and endpoint execution evidence Explanation Correct Answer A:A unified incident links evidence from the attack chain. Incorrect Answers B:Health status alone may not explain correlated indicators. C:Posture scoring cannot reconstruct the particular cross-workload sequence that links the observed incident entities and alerts. D:The first alert may identify entry, but the overall attack requires the linked identity and device events to establish scope and chronology.
Question 542 Five alerts involving the same malicious URL are consolidated under one Defender XDR incident. What does the incident represent? A guarantee that all alerts came from the same attacker A correlated investigation unit grouping potentially related security alerts Treat grouping of multiple URL alerts as proof that investigation and remediation are already complete A statement that every affected account is compromised Explanation Correct Answer B:Correlation reduces disconnected investigations of one campaign. Incorrect Answers A:Related signals still require analyst validation. C:Incident correlation helps analysts work related signals; it does not itself close the case or resolve every underlying entity risk. D:Alert membership does not establish universal compromise.
Question 543 An incident involves a privileged account and destructive activity on production servers, while its first alert was medium severity. How should responders prioritize it? Use the number of employee mailboxes as the only criterion Evaluate incident severity using business impact and full evidence Assign low severity based only on initial alert count, without incorporating production server damage or the compromised privileged account Keep severity fixed to the earliest alert forever Explanation Correct Answer B:Initial alert labels may understate combined impact. Incorrect Answers A:Mailbox count alone does not rate the incident. C:Severity should reflect business impact and observed destructive activity rather than a count of notifications divorced from risk. D:Analysts should consider newly correlated evidence.
Question 544 Automated investigation marks several artifacts remediated but the incident remains active. What should the analyst do? Review investigation results, remaining alerts and containment needs before closure Close the incident immediately when automated remediation reports success for one malicious file, without reviewing residual alerts or identities Treat every remediated artifact as proof no breach occurred Delete the incident to prevent further alerts Explanation Correct Answer A:Automated actions may not resolve every issue. Incorrect Answers B:Automated actions can address selected artifacts while additional user sessions, persistence and linked alerts remain unresolved. C:Remediation does not erase past attacker activity. D:Deleting investigation context is not closure validation.
Question 545 A responder must brief leaders on how a phishing message led to endpoint credential theft. Which Defender XDR view is useful? Use the incident's static first-alert description as the attack narrative without reviewing later endpoint and account evidence Only the final threat intelligence article title The incident's attack story or evidence timeline linking relevant alerts Only an aggregate monthly phishing rate Explanation Correct Answer C:Chronology helps explain initial access and subsequent actions. Incorrect Answers A:A single alert title lacks the sequence that relates phishing delivery, user interaction, and subsequent credential theft. B:An article does not replace incident-specific evidence. D:Aggregate rates cannot reconstruct one case.
Question 546 Several compromised devices and users appear in related XDR alerts. Which investigation action establishes scope? Close all alerts with no device examination Review the incident's affected devices, accounts and related evidence entities Assign all affected employees the incident-response analyst role so they can review their alerts, rather than investigating device and user evidence Disable cloud app discovery for all apps Explanation Correct Answer B:Entity correlation helps identify the exposure surface. Incorrect Answers A:Closing does not prove containment. C:Privileged response assignments do not reconstruct incident scope and unnecessarily expose security data. D:Discovery is not an incident scope investigation.
Question 547 An analyst must find all devices that launched a suspicious process after opening a particular attachment. What tool is relevant? Only the organization's Microsoft 365 adoption reports Search the tenant's current Secure Score improvements as a substitute for correlating email attachment events with process launches Defender XDR advanced hunting across supported email and endpoint tables Only the tenant's backup job history Explanation Correct Answer C:Hunting can correlate process and message indicators. Incorrect Answers A:Adoption does not record process creation. B:Secure Score controls do not record the specific device execution events needed to identify which recipients launched the payload. D:Backups do not expose launched processes.
Question 548 The analyst needs command-line arguments for a malicious process on endpoint devices. Which hunting data family is appropriate? Query email attachment metadata alone and infer command-line parameters for a process subsequently executed on endpoints Only Secure Score control metadata Only IdentityLogonEvents without process records Endpoint process creation telemetry such as DeviceProcessEvents Explanation Correct Answer D:Process-event tables can expose command lines and parent processes. Incorrect Answers A:Mail metadata identifies attachment delivery but not the command-line arguments captured by endpoint process creation telemetry. B:Posture controls do not log command-line executions. C:Logons do not supply device process arguments.
Question 549 A user clicked an email link and ran a payload. Which investigation approach connects the stages? Use only a cloud discovery app category Review only a vulnerability inventory without timestamps Join email and URL click evidence with device process telemetry using stable identifiers and time Treat a matching message subject as proof of endpoint execution without joining URL-click records to process creation events Explanation Correct Answer C:Multi-workload correlation reconstructs the sequence. Incorrect Answers A:App categories do not link one URL click to a process. B:Inventory cannot establish the click-to-execution sequence. D:A delivered or clicked message does not prove the payload ran; correlation of event identifiers and timing is needed.
Question 550 An analyst wants to know whether a suspect executable was created on several devices. Which table family is most relevant? Device file event telemetry with file hashes and device identifiers Only identity MFA registration logs Query the tenant's Defender device licensing status to infer exactly which executable file hashes were written to each endpoint Only email sender reputation totals Explanation Correct Answer A:File events track creation and modification activity. Incorrect Answers B:Factor registration is not file telemetry. C:Entitlements indicate feature eligibility, but file creation and hash evidence require device file event telemetry. D:Sender totals do not prove local file writes.
