Question 580 An incident timeline shows remote service creation across several hosts after an administrator's credentials were stolen. What evidence should be correlated? Only the original phishing email's subject line Only a report of monthly file shares Endpoint service creation, logons and account activity across affected devices Only the organization's domain registration date Explanation Correct Answer C:Cross-host evidence can reveal lateral movement. Incorrect Answers A:Subject alone does not show movement. B:Aggregate file shares cannot prove service creation. D:Domain age is unrelated to host lateral movement.
Question 581 An endpoint starts executing a suspicious scheduled task every hour after initial malware removal. Which evidence matters? Task creation and recurring process execution in the device timeline Only the number of email senders blocked Only a reset of the user's SharePoint permissions Only the current browser home page Explanation Correct Answer A:Persistence can survive removal of an initial file. Incorrect Answers B:Mail statistics do not track scheduled tasks. C:Site access does not remove local persistence. D:A home page is not sufficient task evidence.
Question 582 A compromised device sends unusual outbound traffic to newly registered infrastructure after accessing confidential files. What should be assessed? File access and network connection telemetry correlated by device and time Only a high Secure Score Only whether the employee holds a Teams license Only the office printer queue size Explanation Correct Answer A:Correlation helps distinguish possible data theft. Incorrect Answers B:Posture score cannot rule out data movement. C:Licensing does not establish exfiltration. D:Printing could be separate but does not explain outbound transfer.
Question 583 One compromised Global Administrator signed in to several workload portals. What scope review is needed? Assume no persistence after password rotation Review only the administrator's own mailbox inbox Change only the user's department label Audit privileged actions, application grants and lateral account changes during the compromise window Explanation Correct Answer D:Elevated access can affect many resources. Incorrect Answers A:App grants or tokens may persist independently. B:Privilege enables actions beyond one mailbox. C:Directory metadata does not recover compromised grants.
Question 584 An isolated device cannot access ordinary network resources, and a responder mistakes this for a fresh connectivity failure. What should be verified? The active isolation status and approved response scope in Defender XDR Only the tenant's Microsoft 365 Service health Only the mailbox's forwarding rule Only the office network DHCP lease Explanation Correct Answer A:Containment intentionally restricts communications. Incorrect Answers B:The cloud service may be healthy. C:Forwarding is unrelated to device isolation. D:Network settings do not override deliberate isolation.
Question 585 A junior analyst can see incidents but cannot perform live response or isolate a device. What should the team verify? Defender XDR RBAC permissions and response-action authorization Grant shared Global Administrator credentials to everyone Change the tenant's custom domain suffix Assume all incident viewers can execute commands Explanation Correct Answer A:Observation and response operations can require different roles. Incorrect Answers B:Excessive shared access is unsafe. C:Domain naming cannot grant endpoint response rights. D:Read access is not full response privilege.
Question 586 Multiple users receive a common malicious URL but only some click it. What response should be prioritized? Disable tenant-wide mail security to avoid duplicate alerts Close all user reports because the same URL was blocked Treat every recipient as confirmed credential compromise Identify recipients and clickers, remediate messages and investigate resulting activity Explanation Correct Answer D:Campaign impact differs by user behavior. Incorrect Answers A:Removing controls increases risk. B:Blocked links still require scope checks. C:Receipt alone does not prove a successful attack.
Question 587 A subordinate alert was resolved as benign but other alerts remain open under the same incident. What should happen? Reassess the whole incident and unresolved evidence before final closure Set the entire incident resolved automatically Delete the related identity evidence to reduce noise Close every alert with the same classification Explanation Correct Answer A:One alert disposition does not close all related activity. Incorrect Answers B:Other alerts may still require action. C:Deleting evidence is not completion. D:Different alerts may have distinct truths.
Question 588 A file hash appears on a monitored device and in a threat intelligence report marked low confidence. What should be done? Ignore the indicator regardless of other signs Isolate every device in the company immediately Declare the hash match proof of data exfiltration Validate signer, file context and associated behavior before high-impact containment Explanation Correct Answer D:Low-confidence matches need corroboration. Incorrect Answers A:Low confidence is not zero relevance. B:Broad action exceeds limited evidence. C:A file presence does not establish data theft.
Question 589 Two XDR tables include the same user display name for different accounts. What should a query use to avoid incorrect correlation? Stable account identifiers such as relevant account object IDs where available Ignore the account column entirely Join solely on first and last names Use matching mailbox subject text as the user key Explanation Correct Answer A:Names can be duplicated or renamed. Incorrect Answers B:Losing entity context produces unreliable joins. C:Names are weak unique identifiers. D:Message subjects are not account identity.
Question 590 A query selects every column from massive endpoint tables but only needs device, time and command line. How should it be refined? Expand to include every table in the tenant Remove all time predicates Project the required fields after selective filtering Sort the entire raw dataset before filtering Explanation Correct Answer C:Reducing output columns can improve clarity and efficiency. Incorrect Answers A:More data usually increases noise. B:Unbounded scans may become slower. D:Sorting irrelevant rows adds work.
