Question 630 The initial incident is contained, and the team wants to detect analogous activity on other devices. What should it do? Search only the original affected device Derive relevant behavioral queries and search supported historical telemetry across assets Disable all related detections after containment Rely solely on the closed incident count Explanation Correct Answer B:Postincident hunting checks for unseen related activity. Incorrect Answers A:Other systems could have related activity. C:Detection coverage remains useful after cleanup. D:Case closure does not establish fleet cleanliness.
Question 631 A custom detection triggers device isolation on matches, but a broad filter could match an approved enterprise tool. What should be checked first? Disable change approval requirements entirely Enable automatic isolation tenant-wide immediately Use only the incident name length to decide actions Detection precision, action authorization and bounded rollout before automating disruptive remediation Explanation Correct Answer D:Overbroad detections can cause outages. Incorrect Answers A:Approval is useful for high-impact automation. B:Untested scope risks broad disruption. C:Naming is not evidence of harmful behavior.
Question 632 A risk report highlights high-privilege application consent granted by a normal employee. What should security review? Only the tenant's default calendar timezone Only the device disk free space Consent provenance, granted permissions and whether admin consent policy was bypassed Rely on a publisher-verified app badge without reviewing consent scope or granted privileges Explanation Correct Answer C:Excessive app consent can expand attack surface. Incorrect Answers A:Calendar settings are not app permission policy. B:Storage cannot establish OAuth consent risk. D:Publisher verification does not determine whether high-impact delegated or application permissions were appropriately approved.
Question 633 An admin marks a control as 'planned' but a report shows it was not implemented. What interpretation is appropriate? Changing the control description is equivalent to deployment Planning automatically satisfies the control Planned work is not an effective security control until evidence shows implementation The control has no risk until a breach occurs Explanation Correct Answer C:Tracking status and measured completion are distinct. Incorrect Answers A:Documentation alone does not change configuration. B:Intent does not equal enforcement. D:Unaddressed exposure may be material now.
Question 634 A high-severity incident has remained unassigned across three shifts. What operational defect should be fixed? Delete old alerts to avoid an escalation report Assign accountable incident ownership and escalation with response SLA tracking Remove incident priority labels to simplify queues Let every analyst assume someone else is handling it Explanation Correct Answer B:Unowned incidents can miss containment windows. Incorrect Answers A:Deleting evidence cannot meet response obligations. C:Removing severity does not provide accountability. D:Diffused responsibility delays action.
Question 635 A SHA256 indicator is detected on one endpoint, and the analyst wants to find additional devices containing the same executable. What data should be queried? Search all users' email display names only Count company mailbox licenses Use the original executable filename with no hash check Device file and process events with the exact hash across the relevant fleet Explanation Correct Answer D:Content hashes provide a stronger match than filenames. Incorrect Answers A:Display names cannot identify local binary copies. B:Licenses do not indicate file prevalence. C:Names are commonly reused by unrelated files.
Question 636 A security leader sees Secure Score increased but exposure alerts also rose after onboarding more devices. What explains the mixed signals? The reports must be mathematically contradictory Increased Secure Score ensures incident count must fall Newly onboarded devices cannot change exposure reporting Posture controls and discovered exposure are distinct measures with different denominators Explanation Correct Answer D:More telemetry can reveal previously invisible risk. Incorrect Answers A:Different metrics can move in opposite directions. B:Posture cannot guarantee absence of attacks. C:Asset discovery affects measured risk.
Question 637 A recurring alert is automatically marked resolved, but an associated device still reports malicious activity. What should be examined? Change the device's assigned Outlook account Permanently disable antivirus to stop new alerts Automation rule conditions versus the ongoing device evidence and incident state Assume all device alerts are historical duplicates Explanation Correct Answer C:Auto-resolution does not prove every signal is benign. Incorrect Answers A:Mail account changes do not determine malware activity. B:Removing protection increases exposure. D:Continued activity warrants verification.
Question 638 Suspicious cloud app access follows a compromised identity, but no managed endpoint is detected. What should analysts recognize? Every SaaS account automatically has a Defender endpoint device Only device process hunting can investigate the event No endpoint alert proves cloud activity is authorized Cloud identity or SaaS telemetry can show a compromise without endpoint sensor evidence Explanation Correct Answer D:Not every cloud incident requires a managed device signal. Incorrect Answers A:Cloud accounts and managed devices are distinct. B:Cloud activity and sign-in logs also matter. C:Identity attacks may not execute endpoint malware.
Question 639 An IP indicator includes campaign context and a last-seen date in Defender Threat Intelligence. How should that information be used? Correlate confidence and recency with local connections before classifying an alert Ignore the source confidence metadata Treat old campaign association as permanent IP ownership Replace device timeline events with the intelligence narrative Explanation Correct Answer A:Enrichment is investigative context, not automatic proof. Incorrect Answers B:Reliability changes how strongly evidence is weighed. C:IP assignments and attacker infrastructure evolve. D:A report cannot substitute for tenant telemetry.
Question 640 Three incidents are open: a low-severity simulation, active ransomware on production and a dormant risky configuration. What should responders prioritize? Ignore exposure configuration forever because there is active malware Handle the simulation first because it has more users Contain the active production ransomware while coordinating other findings by risk Process cases strictly by ticket creation date Explanation Correct Answer C:Ongoing destructive activity requires immediate action. Incorrect Answers A:Preventive remediation remains necessary after containment. B:Impact matters more than participation alone. D:Chronological order can miss urgent impact.
