Question 360 During a controlled investigation, a contained device is monitored after a confirmed threat action. Which observation most directly verifies the intended technical behavior? The account's containment state clears and legitimate authentication works without deleting the identity The entity action details identify which specific accounts or devices were contained and which were not Post-action process and network telemetry show whether suspicious execution continued and whether communication was constrained The incident history records classification, closure reason, and analyst explanation linked to the benign event Explanation Correct Answer C:Post-action process and network telemetry show whether suspicious execution continued and whether communication was constrained. Incorrect Answers A:The account's containment state clears and legitimate authentication works without deleting the identity. Post-action process and network telemetry show whether suspicious execution continued and whether communication was constrained. B:The entity action details identify which specific accounts or devices were contained and which were not. Post-action process and network telemetry show whether suspicious execution continued and whether communication was constrained. D:The incident history records classification, closure reason, and analyst explanation linked to the benign event. Post-action process and network telemetry show whether suspicious execution continued and whether communication was constrained.
Question 361 A regional bank needs to restore a legitimate user after an automated containment false positive. Its current security configuration cannot meet this specific operational requirement. Which action should the SOC implement? Check its post-action device timeline and network/process evidence Assess evidence and follow authorized release or remediation workflow Correlate email delivery and click events with endpoint process and network telemetry Inspect the incident's recorded disruption response and affected identity Explanation Correct Answer B:Automatic containment is not an instruction to permanently disable the identity. Incorrect Answers A:Containment does not eliminate the need to verify attacker activity ceased. C:Multi-stage attacks require a timeline spanning mail and device data. D:Disruption evidence identifies containment actions distinct from routine policy blocks.
Question 362 The health network SOC needs to restore a legitimate user after an automated containment false positive, and its change advisory board asks for the technical basis of the recommended method. Which explanation identifies the most relevant capability? Multi-entity response needs per-entity verification rather than one global success assumption. User-level compromise probability is distinct from the risk of one authentication. Automatic containment is not an instruction to permanently disable the identity. Disruption evidence identifies containment actions distinct from routine policy blocks. Explanation Correct Answer C:Automatic containment is not an instruction to permanently disable the identity. Incorrect Answers A:Understanding which related accounts and devices were affected by the same response does not restore a legitimate user after an automated containment false positive. B:Distinguishing risky users from a single risky sign-in does not restore a legitimate user after an automated containment false positive. D:Verifying whether an account containment was caused by automatic attack disruption does not restore a legitimate user after an automated containment false positive.
Question 363 A legitimate user remains blocked after a confirmed attack-disruption false positive, even though the incident was corrected. Which explanation best accounts for the specific failure? Containment prevented communication but did not establish that the threat was removed or the host had stopped malicious processes A response on one entity was incorrectly generalized to all correlated incident entities Temporary identity containment was never reviewed or reversed through an authorized recovery procedure The case handoff omitted investigation notes, evidence references and next-action ownership Explanation Correct Answer C:Temporary identity containment was never reviewed or reversed through an authorized recovery procedure. Incorrect Answers A:Containment prevented communication but did not establish that the threat was removed or the host had stopped malicious processes. Temporary identity containment was never reviewed or reversed through an authorized recovery procedure. B:A response on one entity was incorrectly generalized to all correlated incident entities. Temporary identity containment was never reviewed or reversed through an authorized recovery procedure. D:The case handoff omitted investigation notes, evidence references and next-action ownership. Temporary identity containment was never reviewed or reversed through an authorized recovery procedure.
Question 364 During a controlled investigation, a mistakenly contained legitimate account is released under an approved response decision. Which observation most directly verifies the intended technical behavior? The account's containment state clears and legitimate authentication works without deleting the identity Post-action process and network telemetry show whether suspicious execution continued and whether communication was constrained The entity action details identify which specific accounts or devices were contained and which were not The receiving analyst can access the case's timeline, findings, outstanding tasks and assigned next actions Explanation Correct Answer A:The account's containment state clears and legitimate authentication works without deleting the identity. Incorrect Answers B:Post-action process and network telemetry show whether suspicious execution continued and whether communication was constrained; the account's containment state clears and legitimate authentication works without deleting the identity. C:The entity action details identify which specific accounts or devices were contained and which were not; the account's containment state clears and legitimate authentication works without deleting the identity. D:The receiving analyst can access the case's timeline, findings, outstanding tasks and assigned next actions; the account's containment state clears and legitimate authentication works without deleting the identity.
Question 365 A logistics company needs to understand which related accounts and devices were affected by the same response. Its current security configuration cannot meet this specific operational requirement. Which action should the SOC implement? Correlate Defender for Identity alerts with authentication and endpoint evidence Examine the complete correlated incident entity set and individual action outcomes Assess evidence and follow authorized release or remediation workflow Inspect the incident's recorded disruption response and affected identity Explanation Correct Answer B:Multi-entity response needs per-entity verification rather than one global success assumption. Incorrect Answers A:Lateral movement requires cross-entity timeline analysis, not only a mailbox audit. C:Automatic containment is not an instruction to permanently disable the identity. D:Disruption evidence identifies containment actions distinct from routine policy blocks.
Question 366 The public university SOC needs to understand which related accounts and devices were affected by the same response, and its change advisory board asks for the technical basis of the recommended method. Which explanation identifies the most relevant capability? A unified incident view supports scope assessment across accounts, hosts and artifacts. Multi-entity response needs per-entity verification rather than one global success assumption. Containment does not eliminate the need to verify attacker activity ceased. Disruption evidence identifies containment actions distinct from routine policy blocks. Explanation Correct Answer B:Multi-entity response needs per-entity verification rather than one global success assumption. Incorrect Answers A:Tracking all entities affected by a coordinated multi-workload attack does not understand which related accounts and devices were affected by the same response. C:Determining whether an affected host still shows attacker activity after containment does not understand which related accounts and devices were affected by the same response. D:Verifying whether an account containment was caused by automatic attack disruption does not understand which related accounts and devices were affected by the same response.
Question 367 The SOC reports that every device in one incident was contained, although only an account action appears in the action history. Which explanation best accounts for the specific failure? Containment prevented communication but did not establish that the threat was removed or the host had stopped malicious processes Temporary identity containment was never reviewed or reversed through an authorized recovery procedure A response on one entity was incorrectly generalized to all correlated incident entities Email notification is not incident ownership, status tracking or an escalation workflow Explanation Correct Answer C:A response on one entity was incorrectly generalized to all correlated incident entities. Incorrect Answers A:Containment prevented communication but did not establish that the threat was removed or the host had stopped malicious processes; a response on one entity was incorrectly generalized to all correlated incident entities. B:Temporary identity containment was never reviewed or reversed through an authorized recovery procedure; a response on one entity was incorrectly generalized to all correlated incident entities. D:Email notification is not incident ownership, status tracking or an escalation workflow; a response on one entity was incorrectly generalized to all correlated incident entities.
Question 368 During a controlled investigation, an incident contains multiple affected identities and devices with different response actions. Which observation most directly verifies the intended technical behavior? Post-action process and network telemetry show whether suspicious execution continued and whether communication was constrained The account's containment state clears and legitimate authentication works without deleting the identity The entity action details identify which specific accounts or devices were contained and which were not Incident status, owner, timestamps and escalation task records expose the delay independent of email delivery Explanation Correct Answer C:The entity action details identify which specific accounts or devices were contained and which were not. Incorrect Answers A:Post-action process and network telemetry show whether suspicious execution continued and whether communication was constrained; the entity action details identify which specific accounts or devices were contained and which were not. B:The account's containment state clears and legitimate authentication works without deleting the identity; the entity action details identify which specific accounts or devices were contained and which were not. D:Incident status, owner, timestamps and escalation task records expose the delay independent of email delivery; the entity action details identify which specific accounts or devices were contained and which were not.
Question 369 A health network needs to route a newly triaged high-severity incident to the appropriate SOC team. Its current security configuration cannot meet this specific operational requirement. Which action should the SOC implement? Set a defensible incident classification with analyst comments and supporting evidence Assign the incident owner and classification through approved case workflow Examine the complete correlated incident entity set and individual action outcomes Use incident state, assignment and SLA-oriented workflow views Explanation Correct Answer B:Ownership and status capture investigation responsibility. Incorrect Answers A:Closure needs an evidence-based rationale not a silent disappearance. C:Multi-entity response needs per-entity verification rather than one global success assumption. D:Incident management metadata supports follow-up independent of alert volume.
Question 370 The manufacturer SOC needs to route a newly triaged high-severity incident to the appropriate SOC team, and its change advisory board asks for the technical basis of the recommended method. Which explanation identifies the most relevant capability? Case history keeps the response chain intelligible across analysts. Ownership and status capture investigation responsibility. Incident management metadata supports follow-up independent of alert volume. User-level compromise probability is distinct from the risk of one authentication. Explanation Correct Answer B:Ownership and status capture investigation responsibility. Incorrect Answers A:Preserving escalation context when handing an active case between shifts does not route a newly triaged high-severity incident to the appropriate SOC team. C:Identifying a delayed incident without relying on email notifications alone does not route a newly triaged high-severity incident to the appropriate SOC team. D:Distinguishing risky users from a single risky sign-in does not route a newly triaged high-severity incident to the appropriate SOC team.
