Question 380 During a controlled investigation, a high-severity active incident is handed between two SOC shifts. Which observation most directly verifies the intended technical behavior? The incident history records classification, closure reason, and analyst explanation linked to the benign event Incident status, owner, timestamps and escalation task records expose the delay independent of email delivery Matching account logon records, originating host and subsequent B-side process activity establish the movement path The receiving analyst can access the case's timeline, findings, outstanding tasks and assigned next actions Explanation Correct Answer D:The receiving analyst can access the case's timeline, findings, outstanding tasks and assigned next actions. Incorrect Answers A:The incident history records classification, closure reason, and analyst explanation linked to the benign event; the receiving analyst can access the case's timeline, findings, outstanding tasks and assigned next actions. B:Incident status, owner, timestamps and escalation task records expose the delay independent of email delivery; the receiving analyst can access the case's timeline, findings, outstanding tasks and assigned next actions. C:Matching account logon records, originating host and subsequent B-side process activity establish the movement path; the receiving analyst can access the case's timeline, findings, outstanding tasks and assigned next actions.
Question 381 A government contractor needs to identify a delayed incident without relying on email notifications alone. Its current security configuration cannot meet this specific operational requirement. Which action should the SOC implement? Assess evidence and follow authorized release or remediation workflow Use incident state, assignment and SLA-oriented workflow views Set a defensible incident classification with analyst comments and supporting evidence Assign the incident owner and classification through approved case workflow Explanation Correct Answer B:Incident management metadata supports follow-up independent of alert volume. Incorrect Answers A:Automatic containment is not an instruction to permanently disable the identity. C:Closure needs an evidence-based rationale not a silent disappearance. D:Ownership and status capture investigation responsibility.
Question 382 The insurance provider SOC needs to identify a delayed incident without relying on email notifications alone, and its change advisory board asks for the technical basis of the recommended method. Which explanation identifies the most relevant capability? Case history keeps the response chain intelligible across analysts. Ownership and status capture investigation responsibility. Incident management metadata supports follow-up independent of alert volume. Cross-domain correlation can reveal compromised-session data access. Explanation Correct Answer C:Incident management metadata supports follow-up independent of alert volume. Incorrect Answers A:Preserving escalation context when handing an active case between shifts does not identify a delayed incident without relying on email notifications alone. B:Routing a newly triaged high-severity incident to the appropriate SOC team does not identify a delayed incident without relying on email notifications alone. D:Connecting suspicious Entra logins to a later SaaS download surge does not identify a delayed incident without relying on email notifications alone.
Question 383 The team assumes an unassigned incident will be handled because an email was sent; the incident remains New and unowned after its response deadline. Which explanation best accounts for the specific failure? The closure decision lacks the supporting classification and evidence needed for defensible incident disposition Email notification is not incident ownership, status tracking or an escalation workflow The case handoff omitted investigation notes, evidence references and next-action ownership Incident association alone does not establish identical compromise or response necessity for all entities Explanation Correct Answer B:Email notification is not incident ownership, status tracking or an escalation workflow. Incorrect Answers A:The closure decision lacks the supporting classification and evidence needed for defensible incident disposition. Email notification is not incident ownership, status tracking or an escalation workflow. C:The case handoff omitted investigation notes, evidence references and next-action ownership. Email notification is not incident ownership, status tracking or an escalation workflow. D:Incident association alone does not establish identical compromise or response necessity for all entities. Email notification is not incident ownership, status tracking or an escalation workflow.
Question 384 During a controlled investigation, a Sentinel high-severity incident exceeds the SOC's defined response window. Which observation most directly verifies the intended technical behavior? The incident history records classification, closure reason, and analyst explanation linked to the benign event The receiving analyst can access the case's timeline, findings, outstanding tasks and assigned next actions The entity graph and source alerts show specific compromised nodes and links, enabling scoped containment choices Incident status, owner, timestamps and escalation task records expose the delay independent of email delivery Explanation Correct Answer D:Incident status, owner, timestamps and escalation task records expose the delay independent of email delivery. Incorrect Answers A:The incident history records classification, closure reason, and analyst explanation linked to the benign event; incident status, owner, timestamps and escalation task records expose the delay independent of email delivery. B:The receiving analyst can access the case's timeline, findings, outstanding tasks and assigned next actions; incident status, owner, timestamps and escalation task records expose the delay independent of email delivery. C:The entity graph and source alerts show specific compromised nodes and links, enabling scoped containment choices; incident status, owner, timestamps and escalation task records expose the delay independent of email delivery.
Question 385 A software firm needs to connect a malicious email to a later endpoint process execution. Its current security configuration cannot meet this specific operational requirement. Which action should the SOC implement? Join identity authentication history with cloud-app activity for the same principal Correlate Purview label activity with relevant audit events and identity context Correlate email delivery and click events with endpoint process and network telemetry Use the incident's correlated evidence and entity graph before choosing broad containment Explanation Correct Answer C:Multi-stage attacks require a timeline spanning mail and device data. Incorrect Answers A:Cross-domain correlation can reveal compromised-session data access. B:Label changes alone do not prove a malware infection. D:A unified incident view supports scope assessment across accounts, hosts and artifacts.
Question 386 The legal practice SOC needs to connect a malicious email to a later endpoint process execution, and its change advisory board asks for the technical basis of the recommended method. Which explanation identifies the most relevant capability? Cross-domain correlation can reveal compromised-session data access. Multi-stage attacks require a timeline spanning mail and device data. Lateral movement cannot be established from one isolated endpoint alert. A resource incident needs evidence of identity and control-plane actions. Explanation Correct Answer B:Multi-stage attacks require a timeline spanning mail and device data. Incorrect Answers A:Connecting suspicious Entra logins to a later SaaS download surge does not connect a malicious email to a later endpoint process execution. C:Determining whether an attacker moved from one machine to another using stolen credentials does not connect a malicious email to a later endpoint process execution. D:Tracing a compromised cloud resource through its associated subscription and permissions does not connect a malicious email to a later endpoint process execution.
Question 387 A triage analyst has a delivered phishing email and a later PowerShell alert, but cannot assert they are the same attack. What is the most important missing correlation? A matching recipient/account, device and time-linked email interaction or process chain connecting the two events The fact that both alerts are labeled High severity An unrelated campaign name appearing in a threat-intelligence bulletin A list of all enabled Sentinel playbooks Explanation Correct Answer A:Independent signals need shared entities and a credible time sequence to justify a single cross-domain incident story. Incorrect Answers B:Severity equality does not prove two detections share a causal chain. C:A generic campaign name does not connect the mailbox to the endpoint process. D:Playbook inventory does not establish email-to-process evidence.
Question 388 An incident began with a phishing email followed by a suspicious PowerShell launch on the same user device. Which correlated evidence supports one cross-domain attack story? An unrelated endpoint shows daily benign scheduled-task activity The malicious email appears in one mailbox but no endpoint/process correlation is examined A threat-intelligence indicator exists for a different tenant The email recipient and message timeline align with a device process event linked to the affected user and time window Explanation Correct Answer D:A linked identity, recipient, device and time sequence connects delivery evidence with actual endpoint execution. Incorrect Answers A:Routine tasks on an unrelated device do not connect to the phishing chain. B:An email in isolation is not evidence of a follow-on process event. C:Another tenant’s indicator does not establish this account’s cross-product compromise.
Question 389 A insurance provider needs to connect suspicious Entra logins to a later SaaS download surge. Its current security configuration cannot meet this specific operational requirement. Which action should the SOC implement? Validate remediation status and remaining affected entities before incident closure Use the incident's correlated evidence and entity graph before choosing broad containment Correlate identity sign-ins, remote logons and endpoint events across both devices Join identity authentication history with cloud-app activity for the same principal Explanation Correct Answer D:Cross-domain correlation can reveal compromised-session data access. Incorrect Answers A:One successful action does not automatically resolve all incident evidence. B:A unified incident view supports scope assessment across accounts, hosts and artifacts. C:Lateral movement cannot be established from one isolated endpoint alert.
Question 390 The hospital SOC SOC needs to connect suspicious Entra logins to a later SaaS download surge, and its change advisory board asks for the technical basis of the recommended method. Which explanation identifies the most relevant capability? IRM findings need the context of the policy and risk indicators. Cross-domain correlation can reveal compromised-session data access. Lateral movement cannot be established from one isolated endpoint alert. A unified incident view supports scope assessment across accounts, hosts and artifacts. Explanation Correct Answer B:Cross-domain correlation can reveal compromised-session data access. Incorrect Answers A:Identifying whether a supposed insider exfiltration case meets risk-trigger criteria does not connect suspicious Entra logins to a later SaaS download surge. C:Determining whether an attacker moved from one machine to another using stolen credentials does not connect suspicious Entra logins to a later SaaS download surge. D:Tracking all entities affected by a coordinated multi-workload attack does not connect suspicious Entra logins to a later SaaS download surge.
