Question 860 A traveling executive triggers an unfamiliar-location alert after using cellular roaming. Which corroboration helps assess risk? Device state, travel itinerary, IP reputation, session MFA context and nearby login history Automatically trust the alert because the IP country differs Delete every past location alert without examination Only the account's assigned subscription price Explanation Correct Answer A:Roaming can produce foreign IP geolocation even when the user is authorized. Incorrect Answers B:Geo differences can result from roaming or VPN egress. C:Discarding history reduces visibility into real compromise. D:Licensing cost is not evidence about sign-in legitimacy.
Question 861 An MSP oversees two different Microsoft 365 tenants but wants one tenant's Cloud Apps alerts kept separate. What should it verify? Renaming the MSP dashboard will merge Cloud Apps permissions A shared default domain automatically merges both tenants' app activities Tenant-specific connector authorization and role boundaries for each managed environment One tenant's mailbox transport rule grants access to the other tenant's SaaS telemetry Explanation Correct Answer C:Connector and permission scope should match the appropriate tenant, avoiding cross-tenant assumptions. Incorrect Answers A:A name change cannot grant cross-tenant API rights. B:Tenants remain distinct authorization boundaries. D:Mail routing rules cannot authorize API connectors across tenants.
Question 862 A help desk reviewer needs to investigate alerts but must not edit Cloud Apps policies. Which authorization pattern fits? Grant a supported least-privilege read or investigation role and reserve policy editing for authorized administrators Assign Global Administrator solely to read Cloud Apps alert detail Delete Cloud Apps policy objects after exporting their names Give the reviewer ownership of every connected application Explanation Correct Answer A:Read and policy-management privileges should be deliberately separated. Incorrect Answers B:Broad tenant privilege exceeds a read-only investigation requirement. C:Removal of policies is not a permission-control strategy. D:App ownership does not necessarily map to Cloud Apps investigator permissions.
Question 863 An unsanctioned app was recently recategorized as sanctioned, but endpoints still block it. What should operators check? The status-tag change and its propagation to the endpoint enforcement integration and applied device policy Whether the app's vendor headquarters moved to another country Change the app's visible sanction tag but fail to verify policy export and device enforcement synchronization Wait for cloud-app risk-score rescoring rather than confirm policy/tag propagation to endpoints Explanation Correct Answer A:An old block state can persist until synced or policy is updated on endpoints. Incorrect Answers B:Vendor location does not explain a stale local block state. C:Governance labels must propagate into the relevant enforcement integration before previously blocked endpoints change behavior. D:A risk-score recalculation does not directly clear an existing enforcement policy still applied to endpoints.
Question 864 A purchasing team requests a sanctioned tag for a cloud app with no privacy assessment. What is the sound governance decision? Mark it sanctioned immediately and review only after a breach Treat successful SSO configuration as a full security assurance report Complete risk and data-handling assessment and document an accountable approval before sanctioning Automatically deny all cloud software purchases forever Explanation Correct Answer C:Business demand does not replace due diligence for customer data in a cloud service. Incorrect Answers A:Retroactive review exposes data before controls are established. B:Authentication setup does not assess vendor data practices. D:A blanket denial does not provide a risk-based approval process.
Question 865 Cloud Apps logs a mass export under an application principal rather than a person. What should investigators trace? All Teams meeting participants during the same day The delegated user's mailbox display language The last person who edited the company's default domain Service principal identity, granted permissions, application owner, and corresponding API calls Explanation Correct Answer D:App-only actions may have no interactive human sign-in event to correlate. Incorrect Answers A:A broad meeting roster is not proof of the API principal's authorization. B:Display preferences do not resolve application-only token access. C:Unrelated DNS administration cannot identify the app-only actor.
Question 866 A Cloud Apps file policy receives file metadata but cannot inspect protected document contents. What prerequisite might explain the limitation? Connector-supported file access, protection/decryption capabilities and permissions for that content Whether the app's homepage is in dark mode Whether every employee's password has expired Whether Exchange has an outbound spam exception Explanation Correct Answer A:Metadata visibility alone may not allow full content inspection of encrypted files. Incorrect Answers B:Theme settings do not govern file scan permissions. C:Credential age alone does not grant Cloud Apps access to protected file bytes. D:Transport exceptions do not reveal document contents to the connector.
Question 867 A log collector successfully uploads files, but a newly configured parser omits a whole traffic category. What is the best next action? Treat empty categories as proof the apps are no longer used Immediately sanction every application still in the report Turn off all endpoint web filtering to restore Cloud Discovery parser fields Inspect parser format and field mappings against representative raw records before relying on discovery counts Explanation Correct Answer D:A parsing mismatch can silently drop events and bias shadow-IT reporting. Incorrect Answers A:Unparsed traffic may still represent real sessions. B:Sanctioning cannot repair missing log categories. C:Enforcement removal does not correct parser configuration.
Question 868 An activity policy generates 200 alerts, but only some events have completed remediation actions. What should the analyst measure? Assume one successful action means all policy matches were remediated Assume every alert means the affected session was blocked Count all app sign-ins as completed remediation events Alert matches, selected governance actions, execution status, and exceptions separately Explanation Correct Answer D:Detection volume is not the same as successful containment. Incorrect Answers A:Individual actions can fail or be unsupported. B:Alerts can notify without enforcing a block. C:Authentication activity does not indicate governance action results.
Question 869 A cloud app has a strong security score but users upload data it is not contractually allowed to process. What should determine continued use? Use a lower-risk DNS resolver to transform the app's processing contract The approved data-processing purpose and contract controls, alongside technical vendor posture Ignore the contract because the app has a high score Sanction the app solely because the vendor has SOC audit documents Explanation Correct Answer B:A favorable technical rating does not override organizational contractual restrictions. Incorrect Answers A:DNS services cannot change legal data-use permissions. C:Security controls and lawful processing purpose are distinct. D:Assurance reports do not authorize prohibited data transfers.
Question 870 A Defender XDR incident and Cloud Apps policy alert reference the same user, file hash and period. How should investigators avoid duplicating response? Treat every alert source as a separate compromise and reset all tenant identities Close the Cloud Apps alert as harmless without examining the incident Correlate the shared evidence and manage the related activity within the incident workflow while preserving each signal Delete underlying raw activity after correlating the alerts Explanation Correct Answer C:Linked signals may describe one attack sequence, not unrelated incidents. Incorrect Answers A:Duplicate telemetry does not necessarily indicate independent breaches. B:An overlapping alert can add relevant cloud access context. D:Preserving evidence supports containment and retrospective analysis.
