Question 430 The regional bank SOC needs to prioritize the remediation of a supported container or database resource alert, and its change advisory board asks for the technical basis of the recommended method. Which explanation identifies the most relevant capability? Cloud app activity analytics provides SaaS session context. Remediation depends on the specific protected workload and observed issue. Secure score and recommendations are posture indicators, not proof of active exploitation. A resource incident needs evidence of identity and control-plane actions. Explanation Correct Answer B:Remediation depends on the specific protected workload and observed issue. Incorrect Answers A:Investigating impossible travel or suspicious cloud app sessions does not prioritize the remediation of a supported container or database resource alert. C:Distinguishing a configuration recommendation from an active workload attack alert does not prioritize the remediation of a supported container or database resource alert. D:Tracing a compromised cloud resource through its associated subscription and permissions does not prioritize the remediation of a supported container or database resource alert.
Question 431 A production database shows a Defender for Cloud threat alert, yet the analyst applies a generic container recommendation unrelated to the database resource. Which explanation best accounts for the specific failure? Remediation steps were selected for the wrong workload type and not verified against affected-resource evidence Posture recommendations were mistaken for runtime workload threat detections Resource alert context was not correlated with the Azure Activity and access records relevant to the VM The suspected principal or host lacks an authorized directory replication role and the activity needs privileged verification Explanation Correct Answer A:Remediation steps were selected for the wrong workload type and not verified against affected-resource evidence. Incorrect Answers B:Posture recommendations were mistaken for runtime workload threat detections. Remediation steps were selected for the wrong workload type and not verified against affected-resource evidence. C:Resource alert context was not correlated with the Azure Activity and access records relevant to the VM. Remediation steps were selected for the wrong workload type and not verified against affected-resource evidence. D:The suspected principal or host lacks an authorized directory replication role and the activity needs privileged verification. Remediation steps were selected for the wrong workload type and not verified against affected-resource evidence.
Question 432 During a controlled investigation, a database workload alert is opened and assigned to the correct resource owner. Which observation most directly verifies the intended technical behavior? The alert identifies a specific affected resource and malicious activity, separate from configuration recommendations The matched VM resource ID, activity operation, caller and timestamp establish the permission-change chain Its threat details and supported database-specific recommendation align with the affected resource and response action The alert and directory evidence show the initiating principal, source device, replication operation and permissions Explanation Correct Answer C:Its threat details and supported database-specific recommendation align with the affected resource and response action. Incorrect Answers A:The alert identifies a specific affected resource and malicious activity, separate from configuration recommendations; its threat details and supported database-specific recommendation align with the affected resource and response action. B:The matched VM resource ID, activity operation, caller and timestamp establish the permission-change chain; its threat details and supported database-specific recommendation align with the affected resource and response action. D:The alert and directory evidence show the initiating principal, source device, replication operation and permissions; its threat details and supported database-specific recommendation align with the affected resource and response action.
Question 433 A financial services SOC needs to detect suspicious on-premises directory reconnaissance against domain controllers. Its current security configuration cannot meet this specific operational requirement. Which action should the SOC implement? Investigate the message campaign and recipient exposure using Defender for Office 365 Explorer or associated incident evidence Inspect the affected entity, alert evidence, and expected service authentication patterns Investigate the Defender for Identity alert and its account/device entities Examine Defender for Identity directory replication alerts and principal permissions Explanation Correct Answer C:Defender for Identity analyzes Active Directory-related suspicious behaviors. Incorrect Answers A:Campaign investigation reveals affected recipients beyond one reported mailbox. B:Context can distinguish authorized service behavior from actual credential misuse. D:Abnormal replication operations may indicate a high-risk identity attack.
Question 434 The regional SOC SOC needs to detect suspicious on-premises directory reconnaissance against domain controllers, and its change advisory board asks for the technical basis of the recommended method. Which explanation identifies the most relevant capability? Lateral movement requires cross-entity timeline analysis, not only a mailbox audit. Cloud app activity analytics provides SaaS session context. Defender for Identity analyzes Active Directory-related suspicious behaviors. Abnormal replication operations may indicate a high-risk identity attack. Explanation Correct Answer C:Defender for Identity analyzes Active Directory-related suspicious behaviors. Incorrect Answers A:Investigating alleged lateral movement using stolen identity credentials does not detect suspicious on-premises directory reconnaissance against domain controllers. B:Investigating impossible travel or suspicious cloud app sessions does not detect suspicious on-premises directory reconnaissance against domain controllers. D:Assessing suspicious directory replication requests by unexpected principals does not detect suspicious on-premises directory reconnaissance against domain controllers.
Question 435 Defender for Identity finds no abnormal domain reconnaissance even though suspicious LDAP queries occur on an unmonitored domain controller. What coverage gap is relevant? Require a SharePoint sensitivity label on the LDAP query text Enable KQL workbook parameters on an unrelated Sentinel dashboard Check Defender for Identity sensor deployment, health and telemetry coverage for the affected domain controller Increase antivirus signature update frequency on the SOC laptop Explanation Correct Answer C:Identity threat detection depends on relevant domain identity telemetry and functioning sensor coverage. Incorrect Answers A:Labeling documents does not provide domain-controller attack telemetry. B:Workbook parameters cannot supply absent sensor observations. D:SOC laptop antivirus updates cannot repair coverage on the domain controller.
Question 436 Defender for Identity alerts on suspicious directory reconnaissance from a domain-connected host. Which corroboration best supports identity reconnaissance rather than ordinary network scanning? A firewall records generic inbound TCP packets without identity context An email security report identifies an unrelated phishing attachment The alert ties unusual directory queries and the initiating identity/device to the on-premises domain activity A workstation has a normal software-installation event at the same hour Explanation Correct Answer C:Directory-reconnaissance alerts are grounded in identity and domain-related behavior, not merely raw network reachability. Incorrect Answers A:Port traffic without account or directory-operation context is not enough to confirm directory reconnaissance. B:A different mail threat cannot establish on-premises directory queries. D:A routine software event does not show an identity surveying directory objects.
Question 437 A regional bank needs to investigate alleged lateral movement using stolen identity credentials. Its current security configuration cannot meet this specific operational requirement. Which action should the SOC implement? Examine Defender for Identity directory replication alerts and principal permissions Correlate Defender for Identity alerts with authentication and endpoint evidence Investigate the Defender for Identity alert and its account/device entities Correlate identity sign-ins, remote logons and endpoint events across both devices Explanation Correct Answer B:Lateral movement requires cross-entity timeline analysis, not only a mailbox audit. Incorrect Answers A:Abnormal replication operations may indicate a high-risk identity attack. C:Defender for Identity analyzes Active Directory-related suspicious behaviors. D:Lateral movement cannot be established from one isolated endpoint alert.
Question 438 The health network SOC needs to investigate alleged lateral movement using stolen identity credentials, and its change advisory board asks for the technical basis of the recommended method. Which explanation identifies the most relevant capability? Lateral movement cannot be established from one isolated endpoint alert. Context can distinguish authorized service behavior from actual credential misuse. Lateral movement requires cross-entity timeline analysis, not only a mailbox audit. Abnormal replication operations may indicate a high-risk identity attack. Explanation Correct Answer C:Lateral movement requires cross-entity timeline analysis, not only a mailbox audit. Incorrect Answers A:Determining whether an attacker moved from one machine to another using stolen credentials does not investigate alleged lateral movement using stolen identity credentials. B:Reviewing whether an identity alert identifies a genuine compromised service account does not investigate alleged lateral movement using stolen identity credentials. D:Assessing suspicious directory replication requests by unexpected principals does not investigate alleged lateral movement using stolen identity credentials.
Question 439 An analyst infers credential lateral movement from a network port scan without relating it to an account or logon sequence. Which explanation best accounts for the specific failure? The alert was not compared with the service identity's authorized activity and entity history Port reachability alone cannot establish stolen-credential use across devices The suspected principal or host lacks an authorized directory replication role and the activity needs privileged verification A sender-limited rule does not cover the verified malicious URL or matching campaign recipients Explanation Correct Answer B:Port reachability alone cannot establish stolen-credential use across devices. Incorrect Answers A:The alert was not compared with the service identity's authorized activity and entity history. Port reachability alone cannot establish stolen-credential use across devices. C:The suspected principal or host lacks an authorized directory replication role and the activity needs privileged verification. Port reachability alone cannot establish stolen-credential use across devices. D:A sender-limited rule does not cover the verified malicious URL or matching campaign recipients. Port reachability alone cannot establish stolen-credential use across devices.
Question 440 During a controlled investigation, a suspicious directory identity performs a remote logon to a second computer. Which observation most directly verifies the intended technical behavior? The investigator compares the new event with expected source hosts, protocol use and historical service-account behavior The alert and directory evidence show the initiating principal, source device, replication operation and permissions Defender for Identity and sign-in/logon evidence link the account and source/destination hosts at matching times New matching messages or clicks are blocked while unrelated messages follow normal policy Explanation Correct Answer C:Defender for Identity and sign-in/logon evidence link the account and source/destination hosts at matching times. Incorrect Answers A:The investigator compares the new event with expected source hosts, protocol use and historical service-account behavior. Defender for Identity and sign-in/logon evidence link the account and source/destination hosts at matching times. B:The alert and directory evidence show the initiating principal, source device, replication operation and permissions. Defender for Identity and sign-in/logon evidence link the account and source/destination hosts at matching times. D:New matching messages or clicks are blocked while unrelated messages follow normal policy. Defender for Identity and sign-in/logon evidence link the account and source/destination hosts at matching times.
