Question 370 The manufacturer SOC needs to route a newly triaged high-severity incident to the appropriate SOC team, and its change advisory board asks for the technical basis of the recommended method. Which explanation identifies the most relevant capability? Case history keeps the response chain intelligible across analysts. Ownership and status capture investigation responsibility. Incident management metadata supports follow-up independent of alert volume. User-level compromise probability is distinct from the risk of one authentication. Explanation Correct Answer B:Ownership and status capture investigation responsibility. Incorrect Answers A:Preserving escalation context when handing an active case between shifts does not route a newly triaged high-severity incident to the appropriate SOC team. C:Identifying a delayed incident without relying on email notifications alone does not route a newly triaged high-severity incident to the appropriate SOC team. D:Distinguishing risky users from a single risky sign-in does not route a newly triaged high-severity incident to the appropriate SOC team.
Question 371 A newly created Sentinel incident was assigned to the wrong response queue despite a matching high-severity automation rule. What should the analyst examine first? The endpoint device’s latest antivirus signature version The tenant’s Purview retention policy for Teams chats The workstation BIOS firmware release number The applied automation rule ordering, conditions and owner-assignment actions recorded for the incident Explanation Correct Answer D:Incident workflow assignment can be affected by matching rules, action order and configured ownership targets. Incorrect Answers A:Antivirus signatures do not assign Sentinel incidents. B:Teams retention configuration is unrelated to incident routing. C:Firmware versions do not choose SOC owner queues.
Question 372 A triage analyst transfers a high-severity Sentinel incident to the cloud-response team. Which observation proves ownership transfer without confusing it with attacker remediation? The affected endpoint has its antivirus signatures updated An unrelated detection rule is enabled for all tenants The incident history shows the owner and status updated to the designated cloud responder The alert severity changes automatically without an owner change Explanation Correct Answer C:The incident ownership/activity history records assignment and accountability for SOC case handling. Incorrect Answers A:Signature updates do not identify the responsible investigator for this incident. B:Detection-rule deployment is independent of case ownership. D:Severity change does not prove the incident was assigned to the right analyst.
Question 373 A public university needs to document why a confirmed benign incident was closed. Its current security configuration cannot meet this specific operational requirement. Which action should the SOC implement? Record investigation comments, evidence and next actions on the case Use incident state, assignment and SLA-oriented workflow views Use the incident's correlated evidence and entity graph before choosing broad containment Set a defensible incident classification with analyst comments and supporting evidence Explanation Correct Answer D:Closure needs an evidence-based rationale not a silent disappearance. Incorrect Answers A:Case history keeps the response chain intelligible across analysts. B:Incident management metadata supports follow-up independent of alert volume. C:A unified incident view supports scope assessment across accounts, hosts and artifacts.
Question 374 The retailer SOC needs to document why a confirmed benign incident was closed, and its change advisory board asks for the technical basis of the recommended method. Which explanation identifies the most relevant capability? Closure needs an evidence-based rationale not a silent disappearance. Incident management metadata supports follow-up independent of alert volume. Case history keeps the response chain intelligible across analysts. Risk detections and sign-in details identify unusual authentication rather than endpoint file behavior. Explanation Correct Answer A:Closure needs an evidence-based rationale not a silent disappearance. Incorrect Answers B:Identifying a delayed incident without relying on email notifications alone does not document why a confirmed benign incident was closed. C:Preserving escalation context when handing an active case between shifts does not document why a confirmed benign incident was closed. D:Investigating a risky sign-in associated with impossible travel and unfamiliar devices does not document why a confirmed benign incident was closed.
Question 375 A case is closed as False positive without an explanation, even though investigation comments show a validated benign source. Which explanation best accounts for the specific failure? The closure decision lacks the supporting classification and evidence needed for defensible incident disposition The case handoff omitted investigation notes, evidence references and next-action ownership Email notification is not incident ownership, status tracking or an escalation workflow The analyst has not joined authentication and SaaS activity for the same principal and time window Explanation Correct Answer A:The closure decision lacks the supporting classification and evidence needed for defensible incident disposition. Incorrect Answers B:The case handoff omitted investigation notes, evidence references and next-action ownership; the closure decision lacks the supporting classification and evidence needed for defensible incident disposition. C:Email notification is not incident ownership, status tracking or an escalation workflow; the closure decision lacks the supporting classification and evidence needed for defensible incident disposition. D:The analyst has not joined authentication and SaaS activity for the same principal and time window; the closure decision lacks the supporting classification and evidence needed for defensible incident disposition.
Question 376 During a controlled investigation, an investigated benign alert is closed with a reason and supporting evidence. Which observation most directly verifies the intended technical behavior? The receiving analyst can access the case's timeline, findings, outstanding tasks and assigned next actions Incident status, owner, timestamps and escalation task records expose the delay independent of email delivery Related sign-in and cloud-app activity records share the user, session context, source and ordered timestamps The incident history records classification, closure reason, and analyst explanation linked to the benign event Explanation Correct Answer D:The incident history records classification, closure reason, and analyst explanation linked to the benign event. Incorrect Answers A:The receiving analyst can access the case's timeline, findings, outstanding tasks and assigned next actions; the incident history records classification, closure reason, and analyst explanation linked to the benign event. B:Incident status, owner, timestamps and escalation task records expose the delay independent of email delivery; the incident history records classification, closure reason, and analyst explanation linked to the benign event. C:Related sign-in and cloud-app activity records share the user, session context, source and ordered timestamps; the incident history records classification, closure reason, and analyst explanation linked to the benign event.
Question 377 A media company needs to preserve escalation context when handing an active case between shifts. Its current security configuration cannot meet this specific operational requirement. Which action should the SOC implement? Use incident state, assignment and SLA-oriented workflow views Correlate Safe Links click telemetry with message and recipient evidence Assign the incident owner and classification through approved case workflow Record investigation comments, evidence and next actions on the case Explanation Correct Answer D:Case history keeps the response chain intelligible across analysts. Incorrect Answers A:Incident management metadata supports follow-up independent of alert volume. B:Click events distinguish message delivery from actual user interaction. C:Ownership and status capture investigation responsibility.
Question 378 The software firm SOC needs to preserve escalation context when handing an active case between shifts, and its change advisory board asks for the technical basis of the recommended method. Which explanation identifies the most relevant capability? Case history keeps the response chain intelligible across analysts. Defender for Identity analyzes Active Directory-related suspicious behaviors. Incident management metadata supports follow-up independent of alert volume. Ownership and status capture investigation responsibility. Explanation Correct Answer A:Case history keeps the response chain intelligible across analysts. Incorrect Answers B:Detecting suspicious on-premises directory reconnaissance against domain controllers does not preserve escalation context when handing an active case between shifts. C:Identifying a delayed incident without relying on email notifications alone does not preserve escalation context when handing an active case between shifts. D:Routing a newly triaged high-severity incident to the appropriate SOC team does not preserve escalation context when handing an active case between shifts.
Question 379 The night shift receives an escalated incident but cannot tell which hosts were reviewed or which containment actions remain pending. Which explanation best accounts for the specific failure? The closure decision lacks the supporting classification and evidence needed for defensible incident disposition Email notification is not incident ownership, status tracking or an escalation workflow The case handoff omitted investigation notes, evidence references and next-action ownership The cross-device credential-use chain has not been established with identity and endpoint evidence Explanation Correct Answer C:The case handoff omitted investigation notes, evidence references and next-action ownership. Incorrect Answers A:The closure decision lacks the supporting classification and evidence needed for defensible incident disposition; the case handoff omitted investigation notes, evidence references and next-action ownership. B:Email notification is not incident ownership, status tracking or an escalation workflow; the case handoff omitted investigation notes, evidence references and next-action ownership. D:The cross-device credential-use chain has not been established with identity and endpoint evidence; the case handoff omitted investigation notes, evidence references and next-action ownership.
Question 380 During a controlled investigation, a high-severity active incident is handed between two SOC shifts. Which observation most directly verifies the intended technical behavior? The incident history records classification, closure reason, and analyst explanation linked to the benign event Incident status, owner, timestamps and escalation task records expose the delay independent of email delivery Matching account logon records, originating host and subsequent B-side process activity establish the movement path The receiving analyst can access the case's timeline, findings, outstanding tasks and assigned next actions Explanation Correct Answer D:The receiving analyst can access the case's timeline, findings, outstanding tasks and assigned next actions. Incorrect Answers A:The incident history records classification, closure reason, and analyst explanation linked to the benign event; the receiving analyst can access the case's timeline, findings, outstanding tasks and assigned next actions. B:Incident status, owner, timestamps and escalation task records expose the delay independent of email delivery; the receiving analyst can access the case's timeline, findings, outstanding tasks and assigned next actions. C:Matching account logon records, originating host and subsequent B-side process activity establish the movement path; the receiving analyst can access the case's timeline, findings, outstanding tasks and assigned next actions.
