Question 600 Security Exposure Management finds a dormant account with standing high privilege. What remediation should be evaluated? Increase all administrators' mailbox storage quotas Keep the permanent role assignment but rename its administrative display label Remove the entire tenant's conditional access policies Reduce unnecessary permanent privilege and implement controlled role activation Explanation Correct Answer D:Standing access increases potential blast radius. Incorrect Answers A:Storage has no role in privilege minimization. B:A cosmetic name change leaves the same standing permissions available to a compromised identity. C:Broad policy removal would weaken access.
Question 601 A device previously reported Defender XDR events but stops sending data after an operating-system upgrade. What should be checked? Endpoint sensor/service state, onboarding status and compatibility after upgrade Only the tenant's default domain setting Only the number of recent phishing emails received Only a Teams meeting policy change Explanation Correct Answer A:Telemetry loss can follow agent or platform changes. Incorrect Answers B:Domain defaults cannot restart sensors. C:Mail volume does not establish device sensor health. D:Meetings settings do not determine endpoint telemetry.
Question 602 Several devices contacted the same suspicious domain during an incident. What investigation pivot makes sense? Delete the indicator before searching Start from the domain indicator and enumerate related devices, users and process evidence Review a single randomly chosen user only Treat domain contact as proof of identical compromise everywhere Explanation Correct Answer B:Shared infrastructure may expose the campaign's scope. Incorrect Answers A:Removing the pivot impedes scope discovery. C:Random sampling may miss connected hosts. D:Different hosts may have distinct outcomes.
Question 603 A broad suppression rule created during a test now hides genuine suspicious process alerts. What should be done? Permanently turn off all process detections Leave the rule untouched because it once aided testing Review and narrow or remove the suppression while restoring visibility Only rename the rule for clarity Explanation Correct Answer C:Suppression scope must not mask unrelated attacks. Incorrect Answers A:Global disablement worsens the blind spot. B:Temporary test decisions require reassessment. D:Renaming does not change its matching conditions.
Question 604 Two incidents share the same attacker infrastructure but were separated by several weeks. How should analysts use that observation? Treat each case as wholly unrelated by default Ignore the earlier incident completely Automatically merge cases solely because of one IP match Correlate indicators, timelines and affected entities while retaining case-specific evidence Explanation Correct Answer D:Common infrastructure may reveal a continuing campaign. Incorrect Answers A:Shared indicators warrant investigation. B:Historical evidence may help attribution and scope. C:Shared IPs can be reused or reassigned.
Question 605 A legitimate application named update.exe triggers a malicious-process-name heuristic. What evidence is decisive? The process filename by itself proves benign intent A current high Secure Score proves no malware Signer, file hash, execution path, parent process and observed behavior The employee's job title proves the executable safe Explanation Correct Answer C:Names alone are ambiguous and easily spoofed. Incorrect Answers A:Names can be forged. B:Posture scores are not process attestations. D:Roles do not authenticate binary content.
Question 606 A malicious device has been isolated but its persistence mechanism remains. What must responders avoid claiming? A blocked indicator deletes all file copies automatically Isolation limits communication; eradication requires removal of malicious artifacts The device is fully clean because network is blocked Account compromise is automatically reversed by isolation Explanation Correct Answer B:Containment does not necessarily clean the host. Incorrect Answers A:Indicators are detection and enforcement signals, not always cleanup. C:Offline malware can remain installed. D:Network isolation limits that device’s communication but cannot invalidate a stolen identity token or an active cloud session.
Question 607 A critical server must be isolated during a ransomware incident. What should the commander coordinate? Change service health email recipients only Leave ransomware uncontrolled to avoid any downtime Isolate every tenant endpoint without scoping Containment urgency and service continuity with owners and authorized responders Explanation Correct Answer D:Isolation may disrupt dependent workloads. Incorrect Answers A:Notifications do not manage containment impact. B:Uncontained spread can greatly increase damage. C:Overbroad response causes unnecessary outages.
Question 608 Defender correlates impossible-travel identity alerts and suspicious file downloads from one account. Which coordinated action is appropriate? Only block the user's laptop antivirus scan Only lower the user's mailbox sending limit Investigate sign-ins, revoke sessions and evaluate data access and account recovery Only add the user to a Teams channel Explanation Correct Answer C:A stolen session can expose resources across workloads. Incorrect Answers A:Disabling scanning does not secure the account. B:Message limits do not revoke cloud tokens. D:Collaboration membership is not incident containment.
Question 609 A security team configured a block on a malicious SHA256 but some devices continue executing a similarly named file. What must be checked? Every executable with that filename must share one SHA256 Exact file hashes, supported enforcement scope and endpoint policy deployment Mail recipient domain settings control endpoint execution The display name of the block rule is sufficient Explanation Correct Answer B:Filename similarity does not mean identical binaries or policy reach. Incorrect Answers A:Hashes depend on content, not names. C:SMTP domains do not deploy file blocks. D:Names do not prove enforcement.
Question 610 A security recommendation cannot be applied centrally because a separate team manages the workload. What should be done? Disable other protections to equalize scores Assign accountable remediation owner and track risk acceptance or completion Delete the recommendation from reports Mark it completed without evidence Explanation Correct Answer B:Security posture improvements require coordinated responsibility. Incorrect Answers A:Weakening controls does not solve ownership. C:Report removal does not mitigate risk. D:False closure hides an unresolved exposure.
