Question 400 During a controlled investigation, a coordinated attack spans one phished user and several endpoints. Which observation most directly verifies the intended technical behavior? Related sign-in and cloud-app activity records share the user, session context, source and ordered timestamps The entity graph and source alerts show specific compromised nodes and links, enabling scoped containment choices Matching account logon records, originating host and subsequent B-side process activity establish the movement path Defender for Cloud Apps activity records show user, app, file actions, session and download counts Explanation Correct Answer B:The entity graph and source alerts show specific compromised nodes and links, enabling scoped containment choices. Incorrect Answers A:Related sign-in and cloud-app activity records share the user, session context, source and ordered timestamps; the entity graph and source alerts show specific compromised nodes and links, enabling scoped containment choices. C:Matching account logon records, originating host and subsequent B-side process activity establish the movement path; the entity graph and source alerts show specific compromised nodes and links, enabling scoped containment choices. D:Defender for Cloud Apps activity records show user, app, file actions, session and download counts; the entity graph and source alerts show specific compromised nodes and links, enabling scoped containment choices.
Question 401 A telecom provider needs to investigate impossible travel or suspicious cloud app sessions. Its current security configuration cannot meet this specific operational requirement. Which action should the SOC implement? Review Defender for Cloud Apps activity and anomaly evidence for the user Take an authorized cloud app governance remediation action for the app Open the Defender for Cloud workload protection alert and related machine evidence Use appropriate Defender for Cloud Apps anomaly or activity evidence for the cloud session Explanation Correct Answer A:Cloud app activity analytics provides SaaS session context. Incorrect Answers B:OAuth app controls can revoke or restrict malicious access without deleting unrelated data. C:Workload-protection alerts reveal affected cloud resources and relevant activities. D:Cloud app telemetry can reveal anomalous SaaS download behavior.
Question 402 The regional bank SOC needs to investigate impossible travel or suspicious cloud app sessions, and its change advisory board asks for the technical basis of the recommended method. Which explanation identifies the most relevant capability? IRM findings need the context of the policy and risk indicators. OAuth investigations focus on delegated app privileges and grants rather than device malware alone. Cloud app telemetry can reveal anomalous SaaS download behavior. Cloud app activity analytics provides SaaS session context. Explanation Correct Answer D:Cloud app activity analytics provides SaaS session context. Incorrect Answers A:Identifying whether a supposed insider exfiltration case meets risk-trigger criteria does not investigate impossible travel or suspicious cloud app sessions. B:Investigating a user that granted unusual consent to a third-party OAuth app does not investigate impossible travel or suspicious cloud app sessions. C:Detecting unusual mass downloads from a connected SaaS service does not investigate impossible travel or suspicious cloud app sessions.
Question 403 A Defender for Cloud Apps anomaly alert refers to an unfamiliar SaaS session, but the investigator has only endpoint process data. Why is a session conclusion premature? Cloud app activity records must be correlated with the user, app, session and action before concluding what happened in SaaS Every endpoint process event includes the full SaaS application download history All SaaS traffic is automatically retained in Purview eDiscovery with session details A Microsoft Sentinel workbook always reconstructs missing cloud activity Explanation Correct Answer A:Endpoint telemetry and SaaS activity logs capture different evidence domains; cloud-session claims need cloud application context. Incorrect Answers B:Device processes do not automatically record every SaaS application action. C:eDiscovery content is not a universal session-event log. D:A workbook cannot fabricate unavailable source events.
Question 404 A Defender for Cloud Apps alert alleges a suspicious download from an unmanaged SaaS session. Which record best distinguishes a cloud-session anomaly from an endpoint malware alert? A Defender endpoint antivirus signature version was updated Cloud app activity details show the affected user, application, action, source context and event time A workstation has a process-launch alert for a different user The Microsoft Sentinel connector shows a normal heartbeat from a Linux collector Explanation Correct Answer B:Cloud app session/activity telemetry ties the unusual SaaS action to the user and cloud application. Incorrect Answers A:Antivirus update history does not show SaaS sessions or file actions. C:An endpoint process event for another account is not confirmation of the cloud-app activity. D:Connector availability is not evidence that the suspected SaaS event occurred.
Question 405 A manufacturer needs to investigate a user that granted unusual consent to a third-party OAuth app. Its current security configuration cannot meet this specific operational requirement. Which action should the SOC implement? Examine Defender for Identity directory replication alerts and principal permissions Inspect the app's permissions, consent events and affected users in cloud app governance Use appropriate Defender for Cloud Apps anomaly or activity evidence for the cloud session Review Defender for Cloud Apps activity and anomaly evidence for the user Explanation Correct Answer B:OAuth investigations focus on delegated app privileges and grants rather than device malware alone. Incorrect Answers A:Abnormal replication operations may indicate a high-risk identity attack. C:Cloud app telemetry can reveal anomalous SaaS download behavior. D:Cloud app activity analytics provides SaaS session context.
Question 406 The logistics company SOC needs to investigate a user that granted unusual consent to a third-party OAuth app, and its change advisory board asks for the technical basis of the recommended method. Which explanation identifies the most relevant capability? Cloud app telemetry can reveal anomalous SaaS download behavior. OAuth investigations focus on delegated app privileges and grants rather than device malware alone. Lateral movement requires cross-entity timeline analysis, not only a mailbox audit. Cloud app activity analytics provides SaaS session context. Explanation Correct Answer B:OAuth investigations focus on delegated app privileges and grants rather than device malware alone. Incorrect Answers A:Detecting unusual mass downloads from a connected SaaS service does not investigate a user that granted unusual consent to a third-party OAuth app. C:Investigating alleged lateral movement using stolen identity credentials does not investigate a user that granted unusual consent to a third-party OAuth app. D:Investigating impossible travel or suspicious cloud app sessions does not investigate a user that granted unusual consent to a third-party OAuth app.
Question 407 A third-party OAuth app has a risky consent grant but the analyst checks only device malware telemetry and sees no suspicious executable. Which explanation best accounts for the specific failure? The app's authorized grants and access were not revoked through the supported cloud app governance response The evidence is cloud-session/download activity, not necessarily local malware execution Posture recommendations were mistaken for runtime workload threat detections OAuth app permissions and consent must be assessed in cloud app/Entra governance evidence, not in endpoint file events Explanation Correct Answer D:OAuth app permissions and consent must be assessed in cloud app/Entra governance evidence, not in endpoint file events. Incorrect Answers A:The app's authorized grants and access were not revoked through the supported cloud app governance response. OAuth app permissions and consent must be assessed in cloud app/Entra governance evidence, not in endpoint file events. B:The evidence is cloud-session/download activity, not necessarily local malware execution. OAuth app permissions and consent must be assessed in cloud app/Entra governance evidence, not in endpoint file events. C:Posture recommendations were mistaken for runtime workload threat detections. OAuth app permissions and consent must be assessed in cloud app/Entra governance evidence, not in endpoint file events.
Question 408 During a controlled investigation, a risky OAuth app is granted access to tenant data by one account. Which observation most directly verifies the intended technical behavior? The governance action logs show grant removal or app restriction and subsequent attempted access is denied The app record shows its consented scopes, granting principal and related cloud activity Defender for Cloud Apps activity records show user, app, file actions, session and download counts The alert identifies a specific affected resource and malicious activity, separate from configuration recommendations Explanation Correct Answer B:The app record shows its consented scopes, granting principal and related cloud activity. Incorrect Answers A:The governance action logs show grant removal or app restriction and subsequent attempted access is denied; the app record shows its consented scopes, granting principal and related cloud activity. C:Defender for Cloud Apps activity records show user, app, file actions, session and download counts; the app record shows its consented scopes, granting principal and related cloud activity. D:The alert identifies a specific affected resource and malicious activity, separate from configuration recommendations; the app record shows its consented scopes, granting principal and related cloud activity.
Question 409 A retailer needs to suspend access by a high-risk OAuth application after confirming malicious activity. Its current security configuration cannot meet this specific operational requirement. Which action should the SOC implement? Take an authorized cloud app governance remediation action for the app Use appropriate Defender for Cloud Apps anomaly or activity evidence for the cloud session Inspect the app's permissions, consent events and affected users in cloud app governance Record investigation comments, evidence and next actions on the case Explanation Correct Answer A:OAuth app controls can revoke or restrict malicious access without deleting unrelated data. Incorrect Answers B:Cloud app telemetry can reveal anomalous SaaS download behavior. C:OAuth investigations focus on delegated app privileges and grants rather than device malware alone. D:Case history keeps the response chain intelligible across analysts.
Question 410 The utility operator SOC needs to suspend access by a high-risk OAuth application after confirming malicious activity, and its change advisory board asks for the technical basis of the recommended method. Which explanation identifies the most relevant capability? Remediation depends on the specific protected workload and observed issue. Cloud app telemetry can reveal anomalous SaaS download behavior. Cloud app activity analytics provides SaaS session context. OAuth app controls can revoke or restrict malicious access without deleting unrelated data. Explanation Correct Answer D:OAuth app controls can revoke or restrict malicious access without deleting unrelated data. Incorrect Answers A:Prioritizing the remediation of a supported container or database resource alert does not suspend access by a high-risk OAuth application after confirming malicious activity. B:Detecting unusual mass downloads from a connected SaaS service does not suspend access by a high-risk OAuth application after confirming malicious activity. C:Investigating impossible travel or suspicious cloud app sessions does not suspend access by a high-risk OAuth application after confirming malicious activity.
