Question 480 During a controlled investigation, a suspicious Entra authentication attempt is challenged by Conditional Access. Which observation most directly verifies the intended technical behavior? The sign-in/session evidence shows old sessions invalidated and new authentication required The portal displays the individual sign-in risk and current user risk as distinct values with their respective risk detections The event's policy evaluation details record the applied policy and access result for that exact attempt The scoped case hold records and content preservation status show the evidence remains retained despite user deletion Explanation Correct Answer C:The event's policy evaluation details record the applied policy and access result for that exact attempt. Incorrect Answers A:The sign-in/session evidence shows old sessions invalidated and new authentication required; the event's policy evaluation details record the applied policy and access result for that exact attempt. B:The portal displays the individual sign-in risk and current user risk as distinct values with their respective risk detections; the event's policy evaluation details record the applied policy and access result for that exact attempt. D:The scoped case hold records and content preservation status show the evidence remains retained despite user deletion; the event's policy evaluation details record the applied policy and access result for that exact attempt.
Question 481 A manufacturer needs to investigate a DLP alert suggesting sensitive file exfiltration by a user. Its current security configuration cannot meet this specific operational requirement. Which action should the SOC implement? Preserve relevant content through an authorized eDiscovery hold where justified Correlate Purview label activity with relevant audit events and identity context Examine the policy match and associated Microsoft Purview activity evidence Inspect the app's permissions, consent events and affected users in cloud app governance Explanation Correct Answer C:DLP alert evidence identifies matched actions rather than independently proving successful transfer. Incorrect Answers A:Preservation protects evidence while investigators assess access and policy constraints. B:Label changes alone do not prove a malware infection. D:OAuth investigations focus on delegated app privileges and grants rather than device malware alone.
Question 482 The logistics company SOC needs to investigate a DLP alert suggesting sensitive file exfiltration by a user, and its change advisory board asks for the technical basis of the recommended method. Which explanation identifies the most relevant capability? Label changes alone do not prove a malware infection. Session revocation helps contain established tokens after identity compromise. DLP alert evidence identifies matched actions rather than independently proving successful transfer. Preservation protects evidence while investigators assess access and policy constraints. Explanation Correct Answer C:DLP alert evidence identifies matched actions rather than independently proving successful transfer. Incorrect Answers A:Investigating unexpected changes to sensitivity labels during a suspected breach does not investigate a DLP alert suggesting sensitive file exfiltration by a user. B:Revoking existing sessions after confirmed identity compromise does not investigate a DLP alert suggesting sensitive file exfiltration by a user. D:Avoiding deleting potentially relevant content during a legal security investigation does not investigate a DLP alert suggesting sensitive file exfiltration by a user.
Question 483 Purview creates a High-severity DLP alert for an attempted USB transfer. The investigator assumes that exfiltration succeeded. Which missing information makes that claim unsupported? The document title begins with a confidential prefix The affected account is a guest in Entra ID The actual DLP action outcome—blocked, audited, overridden or allowed—for that specific event A Defender endpoint has an up-to-date antimalware signature Explanation Correct Answer C:DLP alert creation can reflect a detected attempt; enforcement outcome distinguishes a successful transfer from a prevented one. Incorrect Answers A:A title or sensitivity category does not prove transfer success. B:Guest identity alone does not show how the DLP rule acted. D:Antimalware update status is not the policy action outcome.
Question 484 A Purview DLP alert indicates a user attempted to copy sensitive content to an external destination. Which observation distinguishes an attempted policy match from a completed data transfer? The DLP activity and enforcement details specify the user action and whether it was blocked, overridden or allowed The alert severity alone is High A retention label is applied to the originating document A workstation is listed as onboarded to Defender for Endpoint Explanation Correct Answer A:DLP enforcement details are necessary to distinguish detection of a risky attempt from proof that it succeeded. Incorrect Answers B:Severity classifies priority, not whether the policy blocked the transfer. C:A retention label does not establish DLP enforcement or external transfer. D:Endpoint onboarding does not prove the actual DLP outcome for the user action.
Question 485 A retailer needs to identify whether a supposed insider exfiltration case meets risk-trigger criteria. Its current security configuration cannot meet this specific operational requirement. Which action should the SOC implement? Correlate Purview label activity with relevant audit events and identity context Review the Insider Risk Management case and associated indicators with approved access Preserve relevant content through an authorized eDiscovery hold where justified Investigate the message campaign and recipient exposure using Defender for Office 365 Explorer or associated incident evidence Explanation Correct Answer B:IRM findings need the context of the policy and risk indicators. Incorrect Answers A:Label changes alone do not prove a malware infection. C:Preservation protects evidence while investigators assess access and policy constraints. D:Campaign investigation reveals affected recipients beyond one reported mailbox.
Question 486 The utility operator SOC needs to identify whether a supposed insider exfiltration case meets risk-trigger criteria, and its change advisory board asks for the technical basis of the recommended method. Which explanation identifies the most relevant capability? IRM findings need the context of the policy and risk indicators. Preservation protects evidence while investigators assess access and policy constraints. DLP alert evidence identifies matched actions rather than independently proving successful transfer. Remediation depends on the specific protected workload and observed issue. Explanation Correct Answer A:IRM findings need the context of the policy and risk indicators. Incorrect Answers B:Avoiding deleting potentially relevant content during a legal security investigation does not identify whether a supposed insider exfiltration case meets risk-trigger criteria. C:Investigating a DLP alert suggesting sensitive file exfiltration by a user does not identify whether a supposed insider exfiltration case meets risk-trigger criteria. D:Prioritizing the remediation of a supported container or database resource alert does not identify whether a supposed insider exfiltration case meets risk-trigger criteria.
Question 487 An employee is labeled “confirmed insider” because a DLP alert fired, while Insider Risk Management has no risk indicators or matching case context. Which explanation best accounts for the specific failure? Current label state does not identify who changed it or when; audit activity and identity context are needed A DLP alert by itself is not evidence that insider-risk triggers and investigation criteria were met Audit event retention does not place an eDiscovery hold on the mailbox's underlying content A generated script interpretation is not proof of behavior without underlying command/process evidence Explanation Correct Answer B:A DLP alert by itself is not evidence that insider-risk triggers and investigation criteria were met. Incorrect Answers A:Current label state does not identify who changed it or when; audit activity and identity context are needed; a DLP alert by itself is not evidence that insider-risk triggers and investigation criteria were met. C:Audit event retention does not place an eDiscovery hold on the mailbox's underlying content; a DLP alert by itself is not evidence that insider-risk triggers and investigation criteria were met. D:A generated script interpretation is not proof of behavior without underlying command/process evidence; a DLP alert by itself is not evidence that insider-risk triggers and investigation criteria were met.
Question 488 During a controlled investigation, an authorized insider-risk investigation examines a user with correlated risk signals. Which observation most directly verifies the intended technical behavior? Label-change audit events identify the actor, time, affected file and old/new classification where supported The scoped case hold records and content preservation status show the evidence remains retained despite user deletion The relevant risk case and indicators link approved activities and risk rules to the investigated user The explanation is checked against actual script text, command-line arguments and device execution events Explanation Correct Answer C:The relevant risk case and indicators link approved activities and risk rules to the investigated user. Incorrect Answers A:Label-change audit events identify the actor, time, affected file and old/new classification where supported; the relevant risk case and indicators link approved activities and risk rules to the investigated user. B:The scoped case hold records and content preservation status show the evidence remains retained despite user deletion; the relevant risk case and indicators link approved activities and risk rules to the investigated user. D:The explanation is checked against actual script text, command-line arguments and device execution events; the relevant risk case and indicators link approved activities and risk rules to the investigated user.
Question 489 A software firm needs to investigate unexpected changes to sensitivity labels during a suspected breach. Its current security configuration cannot meet this specific operational requirement. Which action should the SOC implement? Correlate Purview label activity with relevant audit events and identity context Check the actual incident timeline and supported data access scope before drawing conclusions Review the Insider Risk Management case and associated indicators with approved access Examine the policy match and associated Microsoft Purview activity evidence Explanation Correct Answer A:Label changes alone do not prove a malware infection. Incorrect Answers B:Copilot output depends on data available to the experience and timing. C:IRM findings need the context of the policy and risk indicators. D:DLP alert evidence identifies matched actions rather than independently proving successful transfer.
Question 490 The legal practice SOC needs to investigate unexpected changes to sensitivity labels during a suspected breach, and its change advisory board asks for the technical basis of the recommended method. Which explanation identifies the most relevant capability? DLP alert evidence identifies matched actions rather than independently proving successful transfer. Label changes alone do not prove a malware infection. IRM findings need the context of the policy and risk indicators. Workload-protection alerts reveal affected cloud resources and relevant activities. Explanation Correct Answer B:Label changes alone do not prove a malware infection. Incorrect Answers A:Investigating a DLP alert suggesting sensitive file exfiltration by a user does not investigate unexpected changes to sensitivity labels during a suspected breach. C:Identifying whether a supposed insider exfiltration case meets risk-trigger criteria does not investigate unexpected changes to sensitivity labels during a suspected breach. D:Triaging a high-severity alert about suspicious command execution on an Azure VM does not investigate unexpected changes to sensitivity labels during a suspected breach.
