Question 390 The hospital SOC SOC needs to connect suspicious Entra logins to a later SaaS download surge, and its change advisory board asks for the technical basis of the recommended method. Which explanation identifies the most relevant capability? IRM findings need the context of the policy and risk indicators. Cross-domain correlation can reveal compromised-session data access. Lateral movement cannot be established from one isolated endpoint alert. A unified incident view supports scope assessment across accounts, hosts and artifacts. Explanation Correct Answer B:Cross-domain correlation can reveal compromised-session data access. Incorrect Answers A:Identifying whether a supposed insider exfiltration case meets risk-trigger criteria does not connect suspicious Entra logins to a later SaaS download surge. C:Determining whether an attacker moved from one machine to another using stolen credentials does not connect suspicious Entra logins to a later SaaS download surge. D:Tracking all entities affected by a coordinated multi-workload attack does not connect suspicious Entra logins to a later SaaS download surge.
Question 391 Two different users show successful Entra logons and one SaaS tenant download surge; the analyst links them without comparing principal identity. Which explanation best accounts for the specific failure? The cross-device credential-use chain has not been established with identity and endpoint evidence Incident association alone does not establish identical compromise or response necessity for all entities The analyst has not joined authentication and SaaS activity for the same principal and time window OAuth app permissions and consent must be assessed in cloud app/Entra governance evidence, not in endpoint file events Explanation Correct Answer C:The analyst has not joined authentication and SaaS activity for the same principal and time window. Incorrect Answers A:The cross-device credential-use chain has not been established with identity and endpoint evidence; the analyst has not joined authentication and SaaS activity for the same principal and time window. B:Incident association alone does not establish identical compromise or response necessity for all entities; the analyst has not joined authentication and SaaS activity for the same principal and time window. D:OAuth app permissions and consent must be assessed in cloud app/Entra governance evidence, not in endpoint file events; the analyst has not joined authentication and SaaS activity for the same principal and time window.
Question 392 During a controlled investigation, a compromised user's Entra sign-in is followed by unusual cloud application downloads. Which observation most directly verifies the intended technical behavior? Related sign-in and cloud-app activity records share the user, session context, source and ordered timestamps Matching account logon records, originating host and subsequent B-side process activity establish the movement path The entity graph and source alerts show specific compromised nodes and links, enabling scoped containment choices The app record shows its consented scopes, granting principal and related cloud activity Explanation Correct Answer A:Related sign-in and cloud-app activity records share the user, session context, source and ordered timestamps. Incorrect Answers B:Matching account logon records, originating host and subsequent B-side process activity establish the movement path. Related sign-in and cloud-app activity records share the user, session context, source and ordered timestamps. C:The entity graph and source alerts show specific compromised nodes and links, enabling scoped containment choices. Related sign-in and cloud-app activity records share the user, session context, source and ordered timestamps. D:The app record shows its consented scopes, granting principal and related cloud activity. Related sign-in and cloud-app activity records share the user, session context, source and ordered timestamps.
Question 393 A regional SOC needs to determine whether an attacker moved from one machine to another using stolen credentials. Its current security configuration cannot meet this specific operational requirement. Which action should the SOC implement? Join identity authentication history with cloud-app activity for the same principal Use the incident's correlated evidence and entity graph before choosing broad containment Examine the policy match and associated Microsoft Purview activity evidence Correlate identity sign-ins, remote logons and endpoint events across both devices Explanation Correct Answer D:Lateral movement cannot be established from one isolated endpoint alert. Incorrect Answers A:Cross-domain correlation can reveal compromised-session data access. B:A unified incident view supports scope assessment across accounts, hosts and artifacts. C:DLP alert evidence identifies matched actions rather than independently proving successful transfer.
Question 394 The telecom provider SOC needs to determine whether an attacker moved from one machine to another using stolen credentials, and its change advisory board asks for the technical basis of the recommended method. Which explanation identifies the most relevant capability? Cross-domain correlation can reveal compromised-session data access. Secure score and recommendations are posture indicators, not proof of active exploitation. A unified incident view supports scope assessment across accounts, hosts and artifacts. Lateral movement cannot be established from one isolated endpoint alert. Explanation Correct Answer D:Lateral movement cannot be established from one isolated endpoint alert. Incorrect Answers A:Connecting suspicious Entra logins to a later SaaS download surge does not determine whether an attacker moved from one machine to another using stolen credentials. B:Distinguishing a configuration recommendation from an active workload attack alert does not determine whether an attacker moved from one machine to another using stolen credentials. C:Tracking all entities affected by a coordinated multi-workload attack does not determine whether an attacker moved from one machine to another using stolen credentials.
Question 395 A SOC infers lateral movement from two machines having malware alerts on the same day without any shared account or remote logon evidence. Which explanation best accounts for the specific failure? The analyst has not joined authentication and SaaS activity for the same principal and time window The cross-device credential-use chain has not been established with identity and endpoint evidence Incident association alone does not establish identical compromise or response necessity for all entities The app's authorized grants and access were not revoked through the supported cloud app governance response Explanation Correct Answer B:The cross-device credential-use chain has not been established with identity and endpoint evidence. Incorrect Answers A:The analyst has not joined authentication and SaaS activity for the same principal and time window; the cross-device credential-use chain has not been established with identity and endpoint evidence. C:Incident association alone does not establish identical compromise or response necessity for all entities; the cross-device credential-use chain has not been established with identity and endpoint evidence. D:The app's authorized grants and access were not revoked through the supported cloud app governance response; the cross-device credential-use chain has not been established with identity and endpoint evidence.
Question 396 During a controlled investigation, a simulated stolen-credential remote logon moves from workstation A to server B. Which observation most directly verifies the intended technical behavior? Matching account logon records, originating host and subsequent B-side process activity establish the movement path Related sign-in and cloud-app activity records share the user, session context, source and ordered timestamps The entity graph and source alerts show specific compromised nodes and links, enabling scoped containment choices The governance action logs show grant removal or app restriction and subsequent attempted access is denied Explanation Correct Answer A:Matching account logon records, originating host and subsequent B-side process activity establish the movement path. Incorrect Answers B:Related sign-in and cloud-app activity records share the user, session context, source and ordered timestamps; matching account logon records, originating host and subsequent B-side process activity establish the movement path. C:The entity graph and source alerts show specific compromised nodes and links, enabling scoped containment choices; matching account logon records, originating host and subsequent B-side process activity establish the movement path. D:The governance action logs show grant removal or app restriction and subsequent attempted access is denied; matching account logon records, originating host and subsequent B-side process activity establish the movement path.
Question 397 A health network needs to track all entities affected by a coordinated multi-workload attack. Its current security configuration cannot meet this specific operational requirement. Which action should the SOC implement? Review Defender for Cloud Apps activity and anomaly evidence for the user Correlate email delivery and click events with endpoint process and network telemetry Join identity authentication history with cloud-app activity for the same principal Use the incident's correlated evidence and entity graph before choosing broad containment Explanation Correct Answer D:A unified incident view supports scope assessment across accounts, hosts and artifacts. Incorrect Answers A:Cloud app activity analytics provides SaaS session context. B:Multi-stage attacks require a timeline spanning mail and device data. C:Cross-domain correlation can reveal compromised-session data access.
Question 398 The manufacturer SOC needs to track all entities affected by a coordinated multi-workload attack, and its change advisory board asks for the technical basis of the recommended method. Which explanation identifies the most relevant capability? A unified incident view supports scope assessment across accounts, hosts and artifacts. Cross-domain correlation can reveal compromised-session data access. Multi-stage attacks require a timeline spanning mail and device data. Lateral movement requires cross-entity timeline analysis, not only a mailbox audit. Explanation Correct Answer A:A unified incident view supports scope assessment across accounts, hosts and artifacts. Incorrect Answers B:Connecting suspicious Entra logins to a later SaaS download surge does not track all entities affected by a coordinated multi-workload attack. C:Connecting a malicious email to a later endpoint process execution does not track all entities affected by a coordinated multi-workload attack. D:Investigating alleged lateral movement using stolen identity credentials does not track all entities affected by a coordinated multi-workload attack.
Question 399 An analyst orders isolation of every asset tagged in a correlated incident without identifying which entities actually executed malicious actions. Which explanation best accounts for the specific failure? The analyst has not joined authentication and SaaS activity for the same principal and time window Incident association alone does not establish identical compromise or response necessity for all entities The cross-device credential-use chain has not been established with identity and endpoint evidence The evidence is cloud-session/download activity, not necessarily local malware execution Explanation Correct Answer B:Incident association alone does not establish identical compromise or response necessity for all entities. Incorrect Answers A:The analyst has not joined authentication and SaaS activity for the same principal and time window; incident association alone does not establish identical compromise or response necessity for all entities. C:The cross-device credential-use chain has not been established with identity and endpoint evidence; incident association alone does not establish identical compromise or response necessity for all entities. D:The evidence is cloud-session/download activity, not necessarily local malware execution; incident association alone does not establish identical compromise or response necessity for all entities.
Question 400 During a controlled investigation, a coordinated attack spans one phished user and several endpoints. Which observation most directly verifies the intended technical behavior? Related sign-in and cloud-app activity records share the user, session context, source and ordered timestamps The entity graph and source alerts show specific compromised nodes and links, enabling scoped containment choices Matching account logon records, originating host and subsequent B-side process activity establish the movement path Defender for Cloud Apps activity records show user, app, file actions, session and download counts Explanation Correct Answer B:The entity graph and source alerts show specific compromised nodes and links, enabling scoped containment choices. Incorrect Answers A:Related sign-in and cloud-app activity records share the user, session context, source and ordered timestamps; the entity graph and source alerts show specific compromised nodes and links, enabling scoped containment choices. C:Matching account logon records, originating host and subsequent B-side process activity establish the movement path; the entity graph and source alerts show specific compromised nodes and links, enabling scoped containment choices. D:Defender for Cloud Apps activity records show user, app, file actions, session and download counts; the entity graph and source alerts show specific compromised nodes and links, enabling scoped containment choices.
