Question 240 During a controlled investigation, one plain syslog line and one properly framed CEF message are sent from a test host. Which observation most directly verifies the intended technical behavior? Only matching facility/severity combinations enter the Syslog table for the controlled test The test event reaches the Syslog table and matches its configured collection filters The plain message appears in Syslog and the CEF-formatted message in CommonSecurityLog The indicator is imported with its collection identity and required metadata in the intelligence store Explanation Correct Answer C:The plain message appears in Syslog and the CEF-formatted message in CommonSecurityLog. Incorrect Answers A:Only matching facility/severity combinations enter the Syslog table for the controlled test; the plain message appears in Syslog and the CEF-formatted message in CommonSecurityLog. B:The test event reaches the Syslog table and matches its configured collection filters; the plain message appears in Syslog and the CEF-formatted message in CommonSecurityLog. D:The indicator is imported with its collection identity and required metadata in the intelligence store; the plain message appears in Syslog and the CEF-formatted message in CommonSecurityLog.
Question 241 A legal practice needs to correlate observed network IPs with an approved threat intelligence feed in Sentinel. Its current security configuration cannot meet this specific operational requirement. Which action should the SOC implement? Ingest threat indicators using a supported threat intelligence connector Inspect source and attributes of the ingested indicator record Respect indicator validity and expiration while managing the intelligence store Configure a Windows Event Forwarding collector and supported ingestion route Explanation Correct Answer A:Threat indicators enrich matches rather than replacing underlying endpoint logs. Incorrect Answers B:Indicator metadata explains provenance, type and confidence. C:Expired indicators should not be treated as permanently active risk. D:WEF consolidates events on a collector rather than installing a new SIEM rule on every source.
Question 242 The government contractor SOC needs to correlate observed network IPs with an approved threat intelligence feed in Sentinel, and its change advisory board asks for the technical basis of the recommended method. Which explanation identifies the most relevant capability? Expired indicators should not be treated as permanently active risk. Log-category support and destination bindings govern the resulting records. Threat indicators enrich matches rather than replacing underlying endpoint logs. Indicator metadata explains provenance, type and confidence. Explanation Correct Answer C:Threat indicators enrich matches rather than replacing underlying endpoint logs. Incorrect Answers A:Preventing expired indicators from causing needless investigation leads does not correlate observed network IPs with an approved threat intelligence feed in Sentinel. B:Diagnosing why a configured diagnostic setting generates no events for a chosen category does not correlate observed network IPs with an approved threat intelligence feed in Sentinel. D:Identifying whether a hash match is based on an imported indicator or an ordinary string search does not correlate observed network IPs with an approved threat intelligence feed in Sentinel.
Question 243 A threat-intelligence analytic rule matches a previously suspicious IP, but the imported indicator expired two months ago. What should the SOC do before treating this as a current intelligence match? Treat any historical indicator as valid forever Check the indicator’s valid-from and expiration context and the observed network evidence before asserting an active match Disable every analytics rule and delete all retained telemetry Assume the IP was used by the same actor for all subsequent events Explanation Correct Answer B:A stale indicator alone is weaker evidence than a current valid feed entry correlated with observed activity. Incorrect Answers A:Indicators have lifecycle and expiry context; retaining old entries does not make them perpetually current. C:Destroying detections and evidence cannot establish the indicator’s present relevance. D:An IP may be reused and does not permanently identify one threat actor.
Question 244 A trusted STIX/TAXII feed contains an IP indicator. An analytic rule should generate an investigative lead only when observed traffic matches a current indicator. Which evidence shows the intended correlation? The feed contains an expired IP indicator but no matching network record A scheduled antivirus scan completed successfully on the device The network event exists but is not compared against the indicator feed An observed network IP joins to the imported active indicator with matching value and valid indicator lifetime Explanation Correct Answer D:An active indicator match with actual telemetry proves threat-intelligence correlation rather than feed storage alone. Incorrect Answers A:An expired uncorrelated indicator is not a current match in endpoint/network evidence. B:Antivirus activity is unrelated to the IP indicator join. C:Raw telemetry without a match does not show indicator-driven threat intelligence enrichment.
Question 245 A hospital SOC needs to prevent expired indicators from causing needless investigation leads. Its current security configuration cannot meet this specific operational requirement. Which action should the SOC implement? Respect indicator validity and expiration while managing the intelligence store Specify the required facilities and levels in the relevant DCR Ingest threat indicators using a supported threat intelligence connector Configure a supported TAXII ingestion connection for the indicator feed Explanation Correct Answer A:Expired indicators should not be treated as permanently active risk. Incorrect Answers B:DCR filters control which Syslog records are forwarded. C:Threat indicators enrich matches rather than replacing underlying endpoint logs. D:TAXII is a transport for structured threat indicators and distinct from Windows event collection.
Question 246 The financial services SOC SOC needs to prevent expired indicators from causing needless investigation leads, and its change advisory board asks for the technical basis of the recommended method. Which explanation identifies the most relevant capability? Expired indicators should not be treated as permanently active risk. Syslog via AMA is the intended connector for Linux Syslog streams. Threat indicators enrich matches rather than replacing underlying endpoint logs. TAXII is a transport for structured threat indicators and distinct from Windows event collection. Explanation Correct Answer A:Expired indicators should not be treated as permanently active risk. Incorrect Answers B:Ingesting supported Linux system logs into Sentinel using Azure monitoring does not prevent expired indicators from causing needless investigation leads. C:Correlating observed network IPs with an approved threat intelligence feed in Sentinel does not prevent expired indicators from causing needless investigation leads. D:Normalizing structured intelligence from a TAXII-compatible source does not prevent expired indicators from causing needless investigation leads.
Question 247 Expired threat indicators still generate matches in a custom hunt that ignores expiration fields. Which explanation best accounts for the specific failure? The query did not join or examine a specific threat-intelligence indicator record The TAXII connector is not correctly configured for that feed's endpoint, collection or credentials The matching logic does not exclude indicators whose valid-until time has passed The source-initiated subscription manager policy points to the wrong collector endpoint Explanation Correct Answer C:The matching logic does not exclude indicators whose valid-until time has passed. Incorrect Answers A:The query did not join or examine a specific threat-intelligence indicator record; the matching logic does not exclude indicators whose valid-until time has passed. B:The TAXII connector is not correctly configured for that feed's endpoint, collection or credentials; the matching logic does not exclude indicators whose valid-until time has passed. D:The source-initiated subscription manager policy points to the wrong collector endpoint; the matching logic does not exclude indicators whose valid-until time has passed.
Question 248 During a controlled investigation, an indicator feed contains one active and one expired indicator with the same format. Which observation most directly verifies the intended technical behavior? The result includes indicator identity, source, validity and the matching observed hash The indicator is imported with its collection identity and required metadata in the intelligence store Only the still-valid indicator is eligible for the configured indicator-matching logic The client establishes the subscription and events arrive in the collector's Forwarded Events log Explanation Correct Answer C:Only the still-valid indicator is eligible for the configured indicator-matching logic. Incorrect Answers A:The result includes indicator identity, source, validity and the matching observed hash; only the still-valid indicator is eligible for the configured indicator-matching logic. B:The indicator is imported with its collection identity and required metadata in the intelligence store; only the still-valid indicator is eligible for the configured indicator-matching logic. D:The client establishes the subscription and events arrive in the collector's Forwarded Events log; only the still-valid indicator is eligible for the configured indicator-matching logic.
Question 249 A telecom provider needs to identify whether a hash match is based on an imported indicator or an ordinary string search. Its current security configuration cannot meet this specific operational requirement. Which action should the SOC implement? Ingest threat indicators using a supported threat intelligence connector Configure a supported TAXII ingestion connection for the indicator feed Onboard supported machines with Azure Arc and AMA then associate the correct DCR Inspect source and attributes of the ingested indicator record Explanation Correct Answer D:Indicator metadata explains provenance, type and confidence. Incorrect Answers A:Threat indicators enrich matches rather than replacing underlying endpoint logs. B:TAXII is a transport for structured threat indicators and distinct from Windows event collection. C:Hybrid machine eligibility and DCR association determine what the collector receives.
Question 250 The regional bank SOC needs to identify whether a hash match is based on an imported indicator or an ordinary string search, and its change advisory board asks for the technical basis of the recommended method. Which explanation identifies the most relevant capability? Expired indicators should not be treated as permanently active risk. Typed table columns improve accurate temporal queries. Indicator metadata explains provenance, type and confidence. TAXII is a transport for structured threat indicators and distinct from Windows event collection. Explanation Correct Answer C:Indicator metadata explains provenance, type and confidence. Incorrect Answers A:Preventing expired indicators from causing needless investigation leads does not identify whether a hash match is based on an imported indicator or an ordinary string search. B:Correcting an incoming timestamp being stored as generic text does not identify whether a hash match is based on an imported indicator or an ordinary string search. D:Normalizing structured intelligence from a TAXII-compatible source does not identify whether a hash match is based on an imported indicator or an ordinary string search.
