Question 850 A service principal has newly granted application permissions to read files across sites, and users did not initiate corresponding downloads. Which evidence is most important? Review admin consent records, granted Graph scopes, app identity, and subsequent API access Inspect only the app's friendly publisher name in the consent prompt and assume all tenant-wide Graph permissions were justified Look only for repeated browser downloads in a single employee session Assume the app is safe because it has existed for two years Explanation Correct Answer A:Application permissions can allow noninteractive access independent of an individual user's browser activity. Incorrect Answers B:Publisher identity alone does not establish who granted broad application permissions or how the token was used. C:Noninteractive API calls may not appear as user browser downloads. D:App age does not establish that a new grant is justified.
Question 851 An OAuth application appears to be using a stolen credential to enumerate confidential files. What is a proportionate first containment step after incident confirmation? Disable all log collection until the app has been investigated Only rename the enterprise application display name Revoke or rotate its compromised credential, restrict the application grant, and preserve investigation evidence Delete every employee account that ever accessed the same files Explanation Correct Answer C:Containment must remove the abused access mechanism while retaining the incident trail. Incorrect Answers A:Turning off telemetry obstructs scoping of API abuse. B:Changing the label does not invalidate a stolen token or secret. D:Broad user deletion is disruptive and does not specifically revoke the app credential.
Question 852 An enterprise application is sanctioned for normal user sign-in but requests tenant-wide administrative read privileges. What should the security approver assess? Grant full directory write access so the vendor can self-limit use Review the new permission scope and business need independently of the application's sanctioned status Rely on the app's sanctioned label to constrain token privileges Approve the scope because the app's existing Discovery rating is low risk Explanation Correct Answer B:An approved application does not automatically justify every API permission or delegated admin grant. Incorrect Answers A:Excessive privileges increase exposure rather than satisfy a read-only need. C:Classification does not automatically narrow OAuth scope. D:Vendor reputation is not the same as least-privilege authorization.
Question 853 A Cloud Apps policy reports mass downloads from one account, and Microsoft Entra ID reports high sign-in risk for that same identity. How should responders prioritize? Suppress the Entra risk event because file activity was already detected Treat the Cloud Apps alert as conclusive without checking identity events Correlate the timelines and session context before deciding on containment of the account or app session Reset the password of every tenant employee immediately Explanation Correct Answer C:Two independent signals increase concern but still require scoped evidence of the affected session. Incorrect Answers A:Different telemetry sources can reveal different parts of the incident. B:Skipping identity context can misattribute authorized or automated downloads. D:Tenant-wide password resets are not proportional to one account's signal.
Question 854 A new SaaS app has an unfavorable risk rating, but employees log in using corporate identities. What additional identity risk should be evaluated? Block mail delivery to the SaaS provider's notification address and assume that revokes corporate SSO tokens and delegated app grants Ignore consent because Cloud Discovery found the application Whether SSO federation and app permissions could expose tokens or overbroad access Assume a low app risk rating proves token handling is secure Explanation Correct Answer C:Vendor posture and actual identity authorization are separate controls. Incorrect Answers A:Email routing changes do not revoke identity federation, OAuth grants or in-app access to the cloud service. B:Discovery visibility does not establish safe delegated privileges. D:An overall score does not certify each authorization flow.
Question 855 Cloud Apps flags unusual file-copy activity during a scheduled tenant-to-tenant migration. What should analysts do before suppressing detection? Require the migration operator to delete every audit event produced Validate migration identity, change approval, time window, destination, and matching event scope Conclude no investigation is needed whenever activity has a high volume Suppress all file activity alerts indefinitely for the tenant Explanation Correct Answer B:A documented migration can be benign, but broad suppression would hide other file movement. Incorrect Answers A:Deleting evidence cannot safely distinguish planned work from compromise. C:High transfer volume alone is not proof of legitimacy. D:A blanket exception removes useful future detection.
Question 856 A Cloud Apps activity policy already matches risky deletion but low-impact reports overwhelm the SOC. What change preserves detection while improving triage? Disable all deletion policies across connected apps Refine policy scope, severity and alert notification routing using demonstrated false-positive patterns Rename the alert policy so analysts stop receiving it Hide all file activity from the Cloud Apps activity log Explanation Correct Answer B:Specific scoping reduces noise without concealing truly risky deletion events. Incorrect Answers A:Global removal sacrifices the detection use case. C:Changing a display name does not alter matching or recipient routing. D:Removing evidence does not improve the policy's precision.
Question 857 An investigation requests a file read that occurred before the Microsoft 365 connector was authorized. What is a realistic limitation? Enabling a new connector guarantees all historical activity since tenant creation Cloud Discovery bandwidth totals reconstruct every past file open An app's risk score preserves its full historical activity log The connector may not retrieve unavailable historical events beyond the source's supported retention and permissions Explanation Correct Answer D:Data ingestion cannot manufacture events never retained or exposed by the source service. Incorrect Answers A:API capabilities and retention bound what can be recovered. B:Network aggregates generally lack file-level event detail. C:Vendor risk assessments are not an event archive.
Question 858 A new employee generates an unusual activity alert before a normal baseline exists. What context matters for review? Changing the employee's display name will establish a behavioral baseline Account age, role, expected onboarding activity, device, and policy risk signals The absence of earlier activity guarantees the alert is a false positive The user must be exempted from all alerts for six months Explanation Correct Answer B:Anomalies can reflect an immature baseline rather than malicious intent. Incorrect Answers A:Profile text cannot substitute for observed activity. C:New accounts can still be compromised immediately. D:Blanket exceptions can hide account takeover.
Question 859 A sanctioned cloud collaboration platform allows public links despite company policy. What does the sanctioned designation establish? All files in the platform are automatically confidential and inaccessible externally The platform is approved for use; its sharing and conditional access settings still require governance Every browser session is forced through a Cloud Apps session proxy by default Cloud app discovery no longer logs the service after sanctioning Explanation Correct Answer B:Approval does not prove every configuration in the sanctioned app meets policy. Incorrect Answers A:Sanctioning is not file permission enforcement. C:A separate access policy and supported integration are necessary. D:Approval does not inherently end activity collection.
Question 860 A traveling executive triggers an unfamiliar-location alert after using cellular roaming. Which corroboration helps assess risk? Device state, travel itinerary, IP reputation, session MFA context and nearby login history Automatically trust the alert because the IP country differs Delete every past location alert without examination Only the account's assigned subscription price Explanation Correct Answer A:Roaming can produce foreign IP geolocation even when the user is authorized. Incorrect Answers B:Geo differences can result from roaming or VPN egress. C:Discarding history reduces visibility into real compromise. D:Licensing cost is not evidence about sign-in legitimacy.
