Question 550 An analyst wants to know whether a suspect executable was created on several devices. Which table family is most relevant? Device file event telemetry with file hashes and device identifiers Only identity MFA registration logs Query the tenant's Defender device licensing status to infer exactly which executable file hashes were written to each endpoint Only email sender reputation totals Explanation Correct Answer A:File events track creation and modification activity. Incorrect Answers B:Factor registration is not file telemetry. C:Entitlements indicate feature eligibility, but file creation and hash evidence require device file event telemetry. D:Sender totals do not prove local file writes.
Question 551 An account logs on to several endpoints unexpectedly after a phishing alert. Which hunting evidence helps? Only a list of Teams channels Only Microsoft Secure Score trend Use aggregate Exchange transport counts as evidence of the compromised identity's successful logons to specific endpoints Identity and endpoint logon records associated with the account Explanation Correct Answer D:Logon telemetry helps trace account movement. Incorrect Answers A:Collaboration membership does not show session events. B:Posture scores do not show account logon paths. C:Email traffic statistics lack user-device logon records and cannot establish which endpoint sign-in events occurred.
Question 552 An analyst runs an expensive hunt across long history with no device filter and receives timeouts. What should be improved? Disable security telemetry collection for speed Bound the query by time and relevant entities, then optimize joins and projections Join every table using display names only Remove all event time filters and join each complete hunting table before constraining to affected devices or accounts Explanation Correct Answer B:Selective queries improve performance and relevance. Incorrect Answers A:Removing evidence defeats detection and hunting. C:Names may be ambiguous or missing. D:Unbounded joins increase processing cost and obscure the targeted event sequence, rather than resolve timeout limits.
Question 553 A KQL query repeatedly identifies a known malicious sequence and the team wants future alerts. What capability should it evaluate? An organization-wide guest invitation setting Schedule an incident search workbook refresh without configuring a supported custom detection rule to evaluate new events Build a recurring advanced hunting report for analysts to open manually, rather than configuring a supported detection rule on the matching event sequence A custom detection rule based on supported hunting query results Explanation Correct Answer D:Scheduled rules can turn a proven query into detections. Incorrect Answers A:Invitations cannot detect the malicious sequence. B:A report refresh can display historical matches, but does not automatically generate the alert behavior required for future detections. C:Scheduled reporting can help retrospective hunting but does not produce the automatic alert required when the suspicious sequence recurs.
Question 554 A query matches harmless admin scripts as often as malicious activity. What should be refined before making it an alert? Shorten the time window without analyzing the behavior of the matching scripts Entity context, exclusions and correlated suspicious behaviors in the detection logic Schedule the existing unfiltered detection every five minutes, leaving legitimate administrator behavior indistinguishable from malicious execution Remove all affected device identities from results Explanation Correct Answer B:Additional signal reduces false positives. Incorrect Answers A:A narrower window may reduce volume but cannot distinguish legitimate administrative activity from attack patterns. C:Increasing evaluation frequency amplifies false positives; refine entity and behavioral context before alerting. D:Broad removal can hide real compromises.
Question 555 An incident happened yesterday but a query uses an hourly lookback. What should be corrected? Delete older alerts to reduce the time window Restrict the hunt further to the last ten minutes because the incident occurred yesterday and newer events are easier to retrieve Use only current-day Secure Score Use an appropriate time range for the incident and data retention window Explanation Correct Answer D:Lookback must encompass the activity under investigation. Incorrect Answers A:Deleting evidence cannot improve investigation scope. B:A short lookback excludes the historical event, so the query must include the actual incident period within retained telemetry. C:Posture score cannot reveal yesterday's events.
Question 556 Two analysts work an incident but response tasks are being duplicated. What Defender XDR workflow improvement matters? Create a second duplicate incident manually Share a common admin password between analysts Assign the incident and document status, notes and task ownership Disable incident alert aggregation so each analyst receives separate unresolved alerts for the same attack Explanation Correct Answer C:Clear responsibility prevents redundant containment. Incorrect Answers A:Duplicate cases fragment evidence. B:Shared identities destroy attribution. D:Splitting correlated evidence makes parallel work less coordinated rather than clarifying assignment and task ownership.
Question 557 A detection triggered on an approved penetration test with verified controls and logs. What disposition can analysts record? Classify the alert using documented investigation findings and correct classification Assume every simulation is a live breach Mark the approved simulated attack as a generic false positive without recording the authorized test window or evidence Turn off all threat policies permanently Explanation Correct Answer A:Evidence-based classification improves future triage. Incorrect Answers B:Authorized tests can legitimately trigger detections. C:An unsubstantiated classification can hide real activity; record the test authorization and findings before disposition. D:One benign test does not justify global disablement.
Question 558 A device may contain volatile evidence, but it also poses active ransomware risk. What should the incident commander balance? Containment urgency, evidence preservation and authorized forensic collection Quarantine the original phishing message and defer any device-containment decision despite ongoing ransomware activity Always wipe every device before identifying affected accounts Always leave destructive malware running to preserve RAM Explanation Correct Answer A:Response must protect systems without losing critical evidence unnecessarily. Incorrect Answers B:Message quarantine may interrupt delivery but cannot stop an infected endpoint that is already executing destructive activity. C:Immediate wiping can destroy evidence and scope. D:Uncontrolled spread can cause further damage.
Question 559 An endpoint is communicating with a known attacker command server. Which response action may limit further network activity while retaining management access? Only mark the incident as resolved Only raise the organization's Secure Score Defender for Endpoint device isolation under supported response controls Remove the original phishing email but leave the already-compromised endpoint free to contact known command-and-control infrastructure Explanation Correct Answer C:Isolation restricts device communications during investigation. Incorrect Answers A:Changing status does not block connections. B:Score improvements do not contain this device. D:Mail removal does not isolate current endpoint network communications to attacker-controlled servers.
Question 560 Defender reports a malware file quarantined, but a malicious scheduled task may persist. What should responders verify? Close the investigation when the original file has been quarantined, without searching task scheduler and process records for surviving persistence The tenant's custom domain verification date Remaining persistence artifacts and follow-up process or task telemetry The identity's license renewal date Explanation Correct Answer C:One file quarantine does not prove full eradication. Incorrect Answers A:Remediating a payload file does not prove that an attacker-created scheduled task or other persistence mechanism was removed. B:Domain proof is unrelated to scheduled tasks. D:Subscriptions do not establish persistence clearance.
