Question 490 The legal practice SOC needs to investigate unexpected changes to sensitivity labels during a suspected breach, and its change advisory board asks for the technical basis of the recommended method. Which explanation identifies the most relevant capability? DLP alert evidence identifies matched actions rather than independently proving successful transfer. Label changes alone do not prove a malware infection. IRM findings need the context of the policy and risk indicators. Workload-protection alerts reveal affected cloud resources and relevant activities. Explanation Correct Answer B:Label changes alone do not prove a malware infection. Incorrect Answers A:Investigating a DLP alert suggesting sensitive file exfiltration by a user does not investigate unexpected changes to sensitivity labels during a suspected breach. C:Identifying whether a supposed insider exfiltration case meets risk-trigger criteria does not investigate unexpected changes to sensitivity labels during a suspected breach. D:Triaging a high-severity alert about suspicious command execution on an Azure VM does not investigate unexpected changes to sensitivity labels during a suspected breach.
Question 491 A sensitivity-label downgrade is suspected, but the SOC only examines the document's current label and misses change history. Which explanation best accounts for the specific failure? A DLP alert by itself is not evidence that insider-risk triggers and investigation criteria were met Audit event retention does not place an eDiscovery hold on the mailbox's underlying content Current label state does not identify who changed it or when; audit activity and identity context are needed An earlier generated summary was treated as a live continuously updated evidence view Explanation Correct Answer C:Current label state does not identify who changed it or when; audit activity and identity context are needed. Incorrect Answers A:A DLP alert by itself is not evidence that insider-risk triggers and investigation criteria were met. Current label state does not identify who changed it or when; audit activity and identity context are needed. B:Audit event retention does not place an eDiscovery hold on the mailbox's underlying content. Current label state does not identify who changed it or when; audit activity and identity context are needed. D:An earlier generated summary was treated as a live continuously updated evidence view. Current label state does not identify who changed it or when; audit activity and identity context are needed.
Question 492 During a controlled investigation, a protected document's sensitivity label changes during an account-compromise window. Which observation most directly verifies the intended technical behavior? The relevant risk case and indicators link approved activities and risk rules to the investigated user The scoped case hold records and content preservation status show the evidence remains retained despite user deletion Label-change audit events identify the actor, time, affected file and old/new classification where supported Regenerating the summary or examining the primary incident timeline reveals the newer alert and its source record Explanation Correct Answer C:Label-change audit events identify the actor, time, affected file and old/new classification where supported. Incorrect Answers A:The relevant risk case and indicators link approved activities and risk rules to the investigated user. Label-change audit events identify the actor, time, affected file and old/new classification where supported. B:The scoped case hold records and content preservation status show the evidence remains retained despite user deletion. Label-change audit events identify the actor, time, affected file and old/new classification where supported. D:Regenerating the summary or examining the primary incident timeline reveals the newer alert and its source record. Label-change audit events identify the actor, time, affected file and old/new classification where supported.
Question 493 A insurance provider needs to avoid deleting potentially relevant content during a legal security investigation. Its current security configuration cannot meet this specific operational requirement. Which action should the SOC implement? Review user risk and sign-in risk as separate signals in Entra identity protection Preserve relevant content through an authorized eDiscovery hold where justified Examine the policy match and associated Microsoft Purview activity evidence Review the Insider Risk Management case and associated indicators with approved access Explanation Correct Answer B:Preservation protects evidence while investigators assess access and policy constraints. Incorrect Answers A:User-level compromise probability is distinct from the risk of one authentication. C:DLP alert evidence identifies matched actions rather than independently proving successful transfer. D:IRM findings need the context of the policy and risk indicators.
Question 494 The hospital SOC SOC needs to avoid deleting potentially relevant content during a legal security investigation, and its change advisory board asks for the technical basis of the recommended method. Which explanation identifies the most relevant capability? IRM findings need the context of the policy and risk indicators. Copilot summaries support analysts but do not substitute for evidence review. Preservation protects evidence while investigators assess access and policy constraints. DLP alert evidence identifies matched actions rather than independently proving successful transfer. Explanation Correct Answer C:Preservation protects evidence while investigators assess access and policy constraints. Incorrect Answers A:Identifying whether a supposed insider exfiltration case meets risk-trigger criteria does not avoid deleting potentially relevant content during a legal security investigation. B:Summarizing a multi-alert security incident without discarding primary evidence does not avoid deleting potentially relevant content during a legal security investigation. D:Investigating a DLP alert suggesting sensitive file exfiltration by a user does not avoid deleting potentially relevant content during a legal security investigation.
Question 495 An investigator tries to ensure a mailbox cannot lose relevant evidence but configures only an Audit record retention setting. Which explanation best accounts for the specific failure? A DLP alert by itself is not evidence that insider-risk triggers and investigation criteria were met Audit event retention does not place an eDiscovery hold on the mailbox's underlying content Current label state does not identify who changed it or when; audit activity and identity context are needed Suggested remediation is not an authorization; scope and supporting telemetry must be verified Explanation Correct Answer B:Audit event retention does not place an eDiscovery hold on the mailbox's underlying content. Incorrect Answers A:A DLP alert by itself is not evidence that insider-risk triggers and investigation criteria were met; audit event retention does not place an eDiscovery hold on the mailbox's underlying content. C:Current label state does not identify who changed it or when; audit activity and identity context are needed; audit event retention does not place an eDiscovery hold on the mailbox's underlying content. D:Suggested remediation is not an authorization; scope and supporting telemetry must be verified; audit event retention does not place an eDiscovery hold on the mailbox's underlying content.
Question 496 During a controlled investigation, a case requires preservation of identified mailbox evidence during legal investigation. Which observation most directly verifies the intended technical behavior? The relevant risk case and indicators link approved activities and risk rules to the investigated user Label-change audit events identify the actor, time, affected file and old/new classification where supported The scoped case hold records and content preservation status show the evidence remains retained despite user deletion The analyst approves only the supported impacted device after checking entity evidence and permissions Explanation Correct Answer C:The scoped case hold records and content preservation status show the evidence remains retained despite user deletion. Incorrect Answers A:The relevant risk case and indicators link approved activities and risk rules to the investigated user; the scoped case hold records and content preservation status show the evidence remains retained despite user deletion. B:Label-change audit events identify the actor, time, affected file and old/new classification where supported; the scoped case hold records and content preservation status show the evidence remains retained despite user deletion. D:The analyst approves only the supported impacted device after checking entity evidence and permissions; the scoped case hold records and content preservation status show the evidence remains retained despite user deletion.
Question 497 A legal practice needs to summarize a multi-alert security incident without discarding primary evidence. Its current security configuration cannot meet this specific operational requirement. Which action should the SOC implement? Use embedded Security Copilot to assist with summarization and verify statements against the incident record Ask an available Security Copilot capability to analyze the script with human verification Check the actual incident timeline and supported data access scope before drawing conclusions Check its post-action device timeline and network/process evidence Explanation Correct Answer A:Copilot summaries support analysts but do not substitute for evidence review. Incorrect Answers B:AI-assisted command explanation is an aid, not proof that execution was malicious. C:Copilot output depends on data available to the experience and timing. D:Containment does not eliminate the need to verify attacker activity ceased.
Question 498 The government contractor SOC needs to summarize a multi-alert security incident without discarding primary evidence, and its change advisory board asks for the technical basis of the recommended method. Which explanation identifies the most relevant capability? AI-assisted command explanation is an aid, not proof that execution was malicious. Multi-stage attacks require a timeline spanning mail and device data. Copilot output depends on data available to the experience and timing. Copilot summaries support analysts but do not substitute for evidence review. Explanation Correct Answer D:Copilot summaries support analysts but do not substitute for evidence review. Incorrect Answers A:Generating a first-pass explanation of a suspicious PowerShell command in an investigation does not summarize a multi-alert security incident without discarding primary evidence. B:Connecting a malicious email to a later endpoint process execution does not summarize a multi-alert security incident without discarding primary evidence. C:Understanding why an AI incident summary omits a recently arrived alert does not summarize a multi-alert security incident without discarding primary evidence.
Question 499 A Security Copilot incident summary names a host as the source of credential theft, but the cited device logs refer to a different host. What is the correct review conclusion? The generated summary should override contradictory raw evidence The analyst must isolate both devices without checking their identities The summary’s natural-language fluency establishes its correctness Treat the unsupported host attribution as unverified and reconcile the original cited telemetry before responding Explanation Correct Answer D:AI-generated conclusions must be corroborated with the actual incident and device records when evidence conflicts. Incorrect Answers A:Narratives cannot supersede the underlying telemetry just because they are generated. B:Arbitrary isolation without entity correlation risks responding to the wrong device. C:Fluent prose does not make an unsupported technical attribution valid.
Question 500 Security Copilot summarizes a multi-alert Defender incident as possible lateral movement. The SOC must decide whether to isolate a device. What evidence-based validation is appropriate? Treat the generated summary as conclusive proof even if the sources are missing Close all underlying alerts because the narrative sounds coherent Open the cited original incident alerts and supporting device/identity telemetry before approving containment Use the summary alone as evidence that every named device was compromised Explanation Correct Answer C:An AI-generated narrative can accelerate analysis but the underlying alerts and telemetry must substantiate response decisions. Incorrect Answers A:Generated text without supporting records is not sufficient for a high-impact security action. B:A readable summary cannot establish that all alerts are benign or resolved. D:Naming an entity in a narrative does not itself prove compromise.
