Question 560 Defender reports a malware file quarantined, but a malicious scheduled task may persist. What should responders verify? Close the investigation when the original file has been quarantined, without searching task scheduler and process records for surviving persistence The tenant's custom domain verification date Remaining persistence artifacts and follow-up process or task telemetry The identity's license renewal date Explanation Correct Answer C:One file quarantine does not prove full eradication. Incorrect Answers A:Remediating a payload file does not prove that an attacker-created scheduled task or other persistence mechanism was removed. B:Domain proof is unrelated to scheduled tasks. D:Subscriptions do not establish persistence clearance.
Question 561 An investigator needs to collect a specific file and run approved response commands on an onboarded device. Which capability fits? A mail transport rule on the user's mailbox Defender for Endpoint live response where supported and authorized Open a vulnerability management recommendation workflow instead of using authorized endpoint response features to retrieve the requested file A Secure Score improvement action Explanation Correct Answer B:Live response enables targeted remote investigation. Incorrect Answers A:Mail flow is not device live response. C:Vulnerability recommendations advise patching but do not provide live collection and command execution on an onboarded device. D:Posture recommendations do not collect arbitrary device files.
Question 562 An analyst only needs to inspect historic suspicious process activity, not execute remote commands. Which view is usually enough? Device wipe and reimage immediately Live response command execution by default Device timeline or relevant advanced hunting event history A cloud app session restriction only Explanation Correct Answer C:Historical telemetry supports passive investigation. Incorrect Answers A:Destructive remediation lacks supporting need. B:Remote execution is unnecessary for passive analysis. D:Browser controls do not expose device process history.
Question 563 Malware stole tokens from a logged-in administrator. Which response should accompany device containment? Only close the endpoint alert after scan completion Change the compromised administrator's visible email alias and assume issued cloud tokens and privileged credentials are invalidated Investigate and revoke affected identity sessions and credentials under the incident plan Only add the malicious file hash to a block list Explanation Correct Answer C:Device isolation alone does not invalidate cloud tokens. Incorrect Answers A:Cloud sessions may remain active. B:SMTP address presentation does not revoke active sign-in sessions or credentials stolen from the endpoint. D:Token theft requires identity response too.
Question 564 Threat intelligence contains one malicious SHA256 and one suspicious IP. What matching distinction matters? A file hash is a public DNS record for the attacker's domain Treat a network IP indicator as if it identifies a unique executable hash rather than communication endpoints across devices Both indicators guarantee malicious activity on any match A file hash identifies binary content; IP indicator identifies network infrastructure Explanation Correct Answer D:Different observables require appropriate telemetry and interpretation. Incorrect Answers A:Hashes and DNS names are not interchangeable. B:File SHA256 and IP infrastructure indicators have different telemetry fields and should be matched to their corresponding event types. C:Indicators require context and can become stale.
Question 565 A defender reports malicious infrastructure associated with an active campaign. What should the analyst do with the indicators? Disable alert collection after reading the article Pivot from trusted threat intelligence into relevant tenant telemetry and validate matches Treat an intelligence article as proof every device is infected Block every endpoint merely because an external intelligence article names a related campaign, without checking local matching evidence Explanation Correct Answer B:Contextual hunting determines local exposure. Incorrect Answers A:Losing telemetry undermines validation. C:Threat reporting is not tenant-specific infection evidence. D:A threat report should guide hunts and validation; it does not prove that all tenant devices participated in the campaign.
Question 566 An IP indicator belonged to an attacker months ago but is now reassigned to a legitimate service. What governance is needed? Review indicator age, confidence, ownership and expiration before maintaining blocks Retain an indefinite block for the historical IP without reviewing reassignment, current ownership or indicator expiry Replace the IP with a random country code Delete all related historical incidents Explanation Correct Answer A:Stale indicators can cause false positives and outages. Incorrect Answers B:IP reputation is time-sensitive and recycled infrastructure can produce false positives if stale indicators are enforced indefinitely. C:A country code is not a precise indicator replacement. D:Past evidence remains useful for analysis.
Question 567 Secure Score recommends several changes, but one fix removes an actively exploited external risk. How should remediation be prioritized? Apply every change instantly without change testing Consider exposure, threat activity, business impact and implementation feasibility Prioritize the control with the largest Secure Score point increase even though another change addresses the actively exploited public exposure Ignore exploited risk if the overall score is high Explanation Correct Answer B:Risk-informed ordering is better than score alone. Incorrect Answers A:Uncontrolled rollout can disrupt business. C:Scoring is one signal; current threat activity, exposed systems and feasible mitigation should drive risk-based sequencing. D:Aggregate posture cannot negate critical exposure.
Question 568 The tenant's Secure Score rose after an MFA policy deployment. What does that indicate? All past phishing incidents are automatically resolved The threat intelligence feed is no longer required Interpret improved MFA control adoption as evidence that phishing and endpoint compromise risks have reached zero Tracked posture controls are now better satisfied, not that all threats are eliminated Explanation Correct Answer D:A score measures recommendation adoption rather than absolute security. Incorrect Answers A:Posture changes do not close investigations. B:Scores do not replace threat investigation. C:Secure Score reflects a set of assessed configurations, not a guarantee that attackers or untracked weaknesses are absent.
Question 569 A board asks for a risk view across devices and identities rather than one configuration score. Which product area is relevant? Microsoft Security Exposure Management initiatives and exposure insights Aggregate Exchange message traces to derive an organization-wide exposure view of vulnerable devices and at-risk identities Only a Microsoft 365 adoption report Only a Purview label color inventory Explanation Correct Answer A:Exposure management connects risk signals across assets. Incorrect Answers B:Mail-flow telemetry is only one workload and cannot replace exposure analytics covering devices, identities and attack paths. C:Product usage is not an exposure assessment. D:Classification colors do not quantify cross-domain exposure.
Question 570 Defender Vulnerability Management reports a critical CVE affecting 40 endpoints. What should the security team correlate? Only Teams usage counts for the affected users Only the number of messages quarantined globally Affected device inventory, exposure severity and exploit evidence before targeted remediation Only the default tenant domain's expiration Explanation Correct Answer C:Device-specific risk helps prioritize patch or mitigation. Incorrect Answers A:Collaboration usage cannot indicate CVE exploitation. B:Mail statistics do not list vulnerable binaries. D:Domain registration is not vulnerability exposure.
