Question 290 The telecom provider SOC needs to turn a proven Advanced Hunting query into regularly scheduled alerting, and its change advisory board asks for the technical basis of the recommended method. Which explanation identifies the most relevant capability? Rule eligibility depends on its data schema and reliable event attribution. TI rules correlate observed indicators against intelligence data. Custom detection rules convert query matches into alerts and permitted responses. Custom detection actions can initiate limited security responses based on rule matches. Explanation Correct Answer C:Custom detection rules convert query matches into alerts and permitted responses. Incorrect Answers A:Identifying the necessary columns and event identity when building a device-event custom detection does not turn a proven Advanced Hunting query into regularly scheduled alerting. B:Detecting matches to known threat indicators with relevant telemetry does not turn a proven Advanced Hunting query into regularly scheduled alerting. D:Containing a device automatically when a high-confidence custom detection matches and response is supported does not turn a proven Advanced Hunting query into regularly scheduled alerting.
Question 291 A detection engineer can manually run an advanced-hunting KQL query and see malicious process matches, but no custom detection alert appears. The query was never saved as a custom detection rule. What is missing? A Sentinel workbook containing the query output A Microsoft Purview retention label on the device An Entra user group named DetectionTeam A configured and enabled custom detection rule with eligible schedule and detection conditions Explanation Correct Answer D:A manually executed hunt does not create scheduled custom detection alerts until the rule is configured. Incorrect Answers A:Workbook visualization is not a Defender XDR custom detection rule. B:Retention labels do not schedule endpoint alerts. C:A group name alone does not deploy or enable a detection rule.
Question 292 A Defender XDR advanced hunting query is converted to a custom detection rule. A matching process event occurs after deployment. Which result most directly validates detection-rule operation? The query returns historical rows only when manually run A Microsoft Sentinel workbook renders a similar query chart The attacker’s process is present in Windows Task Manager with no Defender alert A custom detection alert linked to the matching query evidence is created in the Defender portal Explanation Correct Answer D:Custom detections evaluate scheduled eligible hunting queries and create alerts on matching evidence under supported rule conditions. Incorrect Answers A:Manual query results alone do not prove the custom rule was created and running. B:A workbook visualization is distinct from a Defender XDR detection alert. C:An operating-system process listing is not proof that the detection engine raised an alert.
Question 293 A Defender custom detection based on DeviceProcessEvents creates alerts but the SOC wants reliable attribution to the original endpoint event and device. Which output columns should the query retain? Return only FileName after aggregation and discard device identifiers Return only the latest numeric count without any underlying event identity Return Timestamp, DeviceId and ReportId associated with the original matching event Rename each DeviceId value to an unrelated static label Explanation Correct Answer C:Microsoft recommends event timestamp and device/report identifiers for correct device scope and investigation process-tree linkage; omitting them can degrade attribution. Incorrect Answers A:A filename alone does not preserve the device or report identifier of the triggering event. B:A count without corresponding original-event fields makes alert attribution less reliable. D:Replacing device IDs with fixed labels destroys device-level evidence linking.
Question 294 A detection engineer adds DeviceId and ReportId from the original matched event to a Defender endpoint custom detection query. What practical benefit does this provide? It guarantees every alert is malicious even without investigating the source events It connects the resulting alert to the correct device group and originating event, supporting process-tree investigation It automatically permits the detector to run across every unauthorized tenant It turns an event-level custom detection into an endpoint antivirus signature Explanation Correct Answer B:The event identity fields preserve device attribution and process tree context; they do not prove maliciousness or change tenant authorization. Incorrect Answers A:Source identifiers are investigative context, not proof that all matches are true positives. C:Event columns do not expand tenant security permissions. D:An advanced hunting custom detection is not converted into antivirus signature metadata.
Question 295 A Defender custom detection query saves but the resulting alert lacks the expected device and triggering-event context; the query projected away DeviceId and ReportId. Which explanation best accounts for the specific failure? The query omitted the recommended device and report identifiers needed to associate the custom detection with its originating endpoint event The supported response action was not selected or is unavailable under the current permissions The detection query includes benign maintenance events that should be excluded with narrow source-aware predicates The report conflates a broad ATT&CK tactic with a specific technique and supporting procedure Explanation Correct Answer A:The query omitted the recommended device and report identifiers needed to associate the custom detection with its originating endpoint event. Incorrect Answers B:The supported response action was not selected or is unavailable under the current permissions; the query omitted the recommended device and report identifiers needed to associate the custom detection with its originating endpoint event. C:The detection query includes benign maintenance events that should be excluded with narrow source-aware predicates; the query omitted the recommended device and report identifiers needed to associate the custom detection with its originating endpoint event. D:The report conflates a broad ATT&CK tactic with a specific technique and supporting procedure; the query omitted the recommended device and report identifiers needed to associate the custom detection with its originating endpoint event.
Question 296 During a controlled investigation, a Defender custom detection query returns Timestamp, DeviceId and ReportId from the matching endpoint event. Which observation most directly verifies the intended technical behavior? The resulting test alert points to the correct device and original event, with a meaningful process tree where supported A controlled matching event creates both the detection alert and its recorded response action It suppresses the authorized maintenance events while still alerting on the adversarial test pattern The record separately identifies the Credential Access tactic and an appropriate specific technique supported by observed telemetry Explanation Correct Answer A:The resulting test alert points to the correct device and original event, with a meaningful process tree where supported. Incorrect Answers B:A controlled matching event creates both the detection alert and its recorded response action; the resulting test alert points to the correct device and original event, with a meaningful process tree where supported. C:It suppresses the authorized maintenance events while still alerting on the adversarial test pattern; the resulting test alert points to the correct device and original event, with a meaningful process tree where supported. D:The record separately identifies the Credential Access tactic and an appropriate specific technique supported by observed telemetry; the resulting test alert points to the correct device and original event, with a meaningful process tree where supported.
Question 297 A public university needs to contain a device automatically when a high-confidence custom detection matches and response is supported. Its current security configuration cannot meet this specific operational requirement. Which action should the SOC implement? Create a Microsoft Defender XDR custom detection rule using the validated hunting query Configure a supported custom detection response action with appropriate permissions Include the required timestamp and event identifiers from the applicable table Select a relevant ATT&CK credential access technique and build a source-aligned analytic Explanation Correct Answer B:Custom detection actions can initiate limited security responses based on rule matches. Incorrect Answers A:Custom detection rules convert query matches into alerts and permitted responses. C:Rule eligibility depends on its data schema and reliable event attribution. D:Technique-specific telemetry yields a testable detection requirement.
Question 298 The retailer SOC needs to contain a device automatically when a high-confidence custom detection matches and response is supported, and its change advisory board asks for the technical basis of the recommended method. Which explanation identifies the most relevant capability? Behavioral correlation can combine distinct signals rather than a single static equality predicate. Custom detection rules convert query matches into alerts and permitted responses. Query precision reduces unhelpful alerts without suppressing the entire security product. Custom detection actions can initiate limited security responses based on rule matches. Explanation Correct Answer D:Custom detection actions can initiate limited security responses based on rule matches. Incorrect Answers A:Combining suspicious cross-signal evidence where supported by a platform machine-learning detector does not contain a device automatically when a high-confidence custom detection matches and response is supported. B:Turning a proven Advanced Hunting query into regularly scheduled alerting does not contain a device automatically when a high-confidence custom detection matches and response is supported. C:Avoiding repeated alerts from a poorly scoped broad detection query does not contain a device automatically when a high-confidence custom detection matches and response is supported.
Question 299 A custom detection rule raises alerts but never performs its intended automatic response; only an alert-only action was configured. Which explanation best accounts for the specific failure? The supported response action was not selected or is unavailable under the current permissions The query omitted the recommended device and report identifiers needed to associate the custom detection with its originating endpoint event The detection query includes benign maintenance events that should be excluded with narrow source-aware predicates The analyst mapped a general sign-in signal to a separate credential-access technique without endpoint evidence Explanation Correct Answer A:The supported response action was not selected or is unavailable under the current permissions. Incorrect Answers B:The query omitted the recommended device and report identifiers needed to associate the custom detection with its originating endpoint event; the supported response action was not selected or is unavailable under the current permissions. C:The detection query includes benign maintenance events that should be excluded with narrow source-aware predicates; the supported response action was not selected or is unavailable under the current permissions. D:The analyst mapped a general sign-in signal to a separate credential-access technique without endpoint evidence; the supported response action was not selected or is unavailable under the current permissions.
Question 300 During a controlled investigation, a supported custom detection is configured with an authorized endpoint response action. Which observation most directly verifies the intended technical behavior? The resulting test alert points to the correct device and original event, with a meaningful process tree where supported A controlled matching event creates both the detection alert and its recorded response action It suppresses the authorized maintenance events while still alerting on the adversarial test pattern A matching endpoint technique detection fires with the attack trace and an appropriate ATT&CK mapping Explanation Correct Answer B:A controlled matching event creates both the detection alert and its recorded response action. Incorrect Answers A:The resulting test alert points to the correct device and original event, with a meaningful process tree where supported; a controlled matching event creates both the detection alert and its recorded response action. C:It suppresses the authorized maintenance events while still alerting on the adversarial test pattern; a controlled matching event creates both the detection alert and its recorded response action. D:A matching endpoint technique detection fires with the attack trace and an appropriate ATT&CK mapping; a controlled matching event creates both the detection alert and its recorded response action.
