Question 800 A security baseline was correct last week but a local administrator changed a protected setting on three laptops. What should investigators compare? Only the devices' color labels in inventory Only a tenant-wide Secure Score value Only the employee's Outlook sent-folder size Device configuration history, tamper alerts and effective management policy Explanation Correct Answer D:Evidence distinguishes legitimate updates from unauthorized drift. Incorrect Answers A:Display tags do not establish who changed settings. B:Aggregate scoring may hide device-level drift. C:Mail usage does not show endpoint security edits.
Question 801 A SOC wants Defender for Cloud Apps to ingest supported Microsoft 365 user activity. What integration should be configured? The Microsoft 365 app connector in Defender for Cloud Apps Upload proxy traffic as Cloud Discovery logs without enabling the Microsoft 365 API connector Enable endpoint network discovery while leaving the Microsoft 365 connector disabled Create an activity policy before granting the connector required cloud service permissions Explanation Correct Answer A:Connector integration provides cloud service activity visibility. Incorrect Answers B:Discovery traffic can reveal app access, but it does not replace supported Microsoft 365 API activity ingestion. C:Endpoint-sourced traffic discovery does not supply all detailed app API activity records. D:A policy cannot analyze Microsoft 365 activity that the connector has not ingested.
Question 802 Activity records stopped arriving after a connector authorization change. What should the administrator check? Review discovery traffic counts rather than connector synchronization status Rebuild activity alert policies without checking the connector authorization Connector health, required permissions and latest ingestion errors Raise policy match thresholds and interpret the resulting silence as recovery Explanation Correct Answer C:Missing authorization or health can interrupt app events. Incorrect Answers A:Network observations cannot establish whether the Microsoft 365 API connector is healthy. B:New alert filters will not restore events if API permissions were revoked. D:Alert thresholds operate after ingestion and do not repair a missing event feed.
Question 803 An analyst needs to determine which cloud user downloaded many files from SharePoint within ten minutes. Which record is relevant? Use Cloud App Discovery aggregated traffic totals to infer which named user downloaded the specific SharePoint files within ten minutes Defender for Cloud Apps activity log filtered by user and file activity Review cloud app risk-score reports rather than filter the user's file-download activity events Review the current Microsoft 365 security posture score rather than the user's time-filtered cloud application download events Explanation Correct Answer B:SaaS activity records can show file access events. Incorrect Answers A:Aggregate discovery identifies applications and volumes but cannot replace activity-event details associated with the actor and files. C:Discovery scores help assess app risk but do not identify which user downloaded specific files and when. D:Secure Score describes control adoption and not the exact file activity chronology requested by the investigator.
Question 804 A user downloads unusually many sensitive files from Microsoft 365 during offboarding. What should analysts correlate? Activity log volume, user context, file sensitivity and sign-in evidence Assume corporate IP means the download was safe Treat the user's device compliance state alone as the final risk conclusion Assume every large download is malicious Explanation Correct Answer A:Unusual file access needs context and scope investigation. Incorrect Answers B:Trusted networks do not prove authorization. C:A compliant device does not establish whether bulk sensitive downloads were appropriate for the user's offboarding context. D:Approved migrations may also produce volume.
Question 805 Security wants to alert on large-scale deletion of corporate cloud files. Which Defender for Cloud Apps policy fits? Activity policy matching deletion operations and target conditions Only a file policy filtering encrypted documents Treat an endpoint antivirus alert as a complete inventory of all cloud applications accessed through the corporate proxy Only a tenant mail transport rule Explanation Correct Answer A:Activity policy can alert on supported cloud actions. Incorrect Answers B:File content classification does not necessarily track deletion events. C:Endpoint malware telemetry cannot replace app discovery data drawn from supported traffic or logs. D:Transport cannot detect SaaS deletion activity.
Question 806 A user has successful cloud sign-ins from distant regions within an implausibly short interval. What policy family is relevant? Assume an atypical location is malicious without checking VPN exits, IP geolocation and sign-in context Tighten outgoing email spam rules without correlating the user's cloud sign-in locations A file policy classifying a document keyword Anomaly detection for impossible travel with location context Explanation Correct Answer D:Behavior analytics can flag unusual geographic patterns. Incorrect Answers A:Impossible travel signals need context; VPN infrastructure and address geolocation can generate misleading distance estimates. B:Mail sending protections do not explain the apparently simultaneous cloud sessions from distant regions. C:File content does not evaluate sign-in geography.
Question 807 An employee's corporate VPN exits in two countries during one meeting and triggers a travel anomaly. What should analysts review? Calculate app risk solely from how many employees have Microsoft 365 subscriptions, not actual discovered app traffic VPN egress, known user behavior, IP enrichment and sign-in timing All VPN users should be permanently exempt from risk signals A travel alert is infallible proof of stolen credentials Explanation Correct Answer B:Infrastructure can create apparent geographic contradictions. Incorrect Answers A:Microsoft 365 subscription counts do not describe use or risk posture of separate cloud services discovered in network data. C:Broad exemptions conceal real attacks. D:VPN routing can cause benign anomalies.
Question 808 A newly authorized cloud app requests extensive Microsoft Graph permissions and accesses executive files. What should the team inspect? App permissions, consent history, publisher and access behavior Rely solely on the application display name and listed publisher Inspect only interactive sign-ins while excluding application-only API access Use only the cloud app risk rating without inspecting API grants Explanation Correct Answer A:OAuth abuse can grant broad cloud data access. Incorrect Answers B:A familiar name is not enough to assess the permissions that were actually granted or used. C:App-only access can read files without a corresponding interactive user session. D:Vendor posture cannot establish whether this app has overbroad tenant permissions.
Question 809 Security wants to prevent ordinary employees granting excessive permissions to unverified applications. What controls should be evaluated? Remove all API audit logs Block one discovered cloud application instead of governing user consent to high-privilege OAuth grants Enable anonymous app consent for all third-party apps App consent governance policies and admin approval requirements for high-risk permissions Explanation Correct Answer D:Governance limits unauthorized application access. Incorrect Answers A:Suppressing evidence does not reduce permissions. B:An app discovery block alone does not prevent end users from consenting to other unverified applications with broad permissions. C:Open consent can increase risk.
Question 810 An integrated application suddenly reads ten times more data than usual following a permission grant. What should analysts do? Assume every high-volume API call is an authorized backup Only inspect human user passwords Review application behavior, granted scopes and activity provenance Only change the app's display name Explanation Correct Answer C:Anomalous app access may indicate compromised or abused consent. Incorrect Answers A:Volume alone does not prove purpose. B:App-only grants can act without user passwords. D:Names do not revoke access.
