Question 590 A query selects every column from massive endpoint tables but only needs device, time and command line. How should it be refined? Expand to include every table in the tenant Remove all time predicates Project the required fields after selective filtering Sort the entire raw dataset before filtering Explanation Correct Answer C:Reducing output columns can improve clarity and efficiency. Incorrect Answers A:More data usually increases noise. B:Unbounded scans may become slower. D:Sorting irrelevant rows adds work.
Question 591 Advanced hunting shows a process opened a network connection to an external IP, but payload transmission is not proven. What can be claimed? Suspicious outbound contact occurred; confirm transferred data before asserting exfiltration A nonzero port always identifies ransomware An empty mailbox trace proves no endpoint traffic Every TCP connection proves sensitive files were stolen Explanation Correct Answer A:Connection evidence alone does not prove data contents. Incorrect Answers B:Ports alone are not definitive attribution. C:Email telemetry cannot rule out other network flows. D:Connections can have benign or blocked outcomes.
Question 592 An analyst expects endpoint telemetry from a new server, but it has never sent a device record. What should be checked? Only the tenant's sensitivity label catalog Only the server's Exchange mailbox permission Only the service health incident list Defender for Endpoint onboarding and sensor health of the server Explanation Correct Answer D:No onboarded sensor means missing endpoint evidence. Incorrect Answers A:Classification does not activate a sensor. B:Mailbox permissions do not onboard endpoint telemetry. C:Service status cannot show server onboarding.
Question 593 A responder needs process events from eight months ago but advanced hunting contains a shorter supported lookback. What should they confirm? Available retention, configured data exports and any longer-term storage sources Secure Score automatically archives all raw process data indefinitely The data must never have existed Changing a report's date picker can always recover all old data Explanation Correct Answer A:Hunting cannot query events beyond accessible retention. Incorrect Answers B:Posture scoring is not unlimited event storage. C:Absent historic rows may simply have aged out. D:Interface changes cannot recreate expired telemetry.
Question 594 An attacker may have granted a third-party app broad permissions to read organizational data. Which evidence should be investigated? Only antivirus signature age on workstations Only the mailbox spam quarantine volume Review only the enterprise application display name without its consent grants App consent events, service principal permissions and associated account activity Explanation Correct Answer D:OAuth grants can permit persistent application access. Incorrect Answers A:Endpoint definitions do not list cloud grants. B:Quarantine does not identify app consent. C:Names can be spoofed and do not describe the granted Microsoft Graph permissions.
Question 595 A compromised mailbox contains a newly created rule forwarding finance messages externally. What should responders review? Mailbox rule changes, account sign-ins and related incident evidence Only SharePoint item retention periods Only endpoint software inventory Check current inbox-rule state only, without reviewing changes and sign-in evidence Explanation Correct Answer A:Unauthorized forwarding can persist after initial access. Incorrect Answers B:Retention does not explain inbox forwarding. C:Inventory cannot prove cloud mailbox rule changes. D:The current setting establishes possible persistence but not when or by whom the rule was introduced.
Question 596 An incident contains anomalous mass SharePoint downloads after identity compromise. What should be correlated? Only the overall Secure Score change Only the local device malware scan result Review device process executions alone without matching the cloud session or file events User sign-in and cloud app file activity for the same account and time Explanation Correct Answer D:Combined telemetry helps confirm unauthorized access. Incorrect Answers A:Posture score cannot prove specific downloads. B:Cloud downloads can occur without malware detection. C:A local process timeline does not identify which cloud identity downloaded the SharePoint files.
Question 597 A security case suggests app refresh tokens were stolen. What recovery area is relevant? Only clear phishing emails from Inbox Only change the mailbox display name Only block an unrelated IP range Revoke affected app sessions and credentials and investigate consent or secret exposure Explanation Correct Answer D:App tokens can allow access beyond a user password. Incorrect Answers A:Mail removal does not revoke app tokens. B:Names do not revoke app credentials. C:Narrow blocks may miss token reuse.
Question 598 The phishing URL in an email redirects through two domains before credential capture. Which approach helps analysts understand the campaign? Judge risk solely by the first domain's popularity Treat every redirect as malicious without examining it Review URL clicks, redirect destinations and related network evidence in context Review only the user's device serial number Explanation Correct Answer C:The intermediate chain can hide the final destination. Incorrect Answers A:Trusted redirects can lead to malicious content. B:Legitimate web services also redirect. D:Serial numbers do not reconstruct URL behavior.
Question 599 Two intelligence reports disagree about whether an IP is malicious. What should the responder weigh? Treat the oldest report as permanently authoritative Ignore local tenant logs because the reports conflict Source reliability, timestamp, observed tenant behavior and corroborating indicators Treat the newest report as automatically infallible Explanation Correct Answer C:Threat intelligence should be interpreted with context. Incorrect Answers A:Threat infrastructure can change ownership. B:Local evidence is essential to adjudication. D:Recent claims may still be incorrect.
Question 600 Security Exposure Management finds a dormant account with standing high privilege. What remediation should be evaluated? Increase all administrators' mailbox storage quotas Keep the permanent role assignment but rename its administrative display label Remove the entire tenant's conditional access policies Reduce unnecessary permanent privilege and implement controlled role activation Explanation Correct Answer D:Standing access increases potential blast radius. Incorrect Answers A:Storage has no role in privilege minimization. B:A cosmetic name change leaves the same standing permissions available to a compromised identity. C:Broad policy removal would weaken access.
