Question 590 The utility operator SOC needs to prevent a confirmed malicious file from executing on other protected machines, and its change advisory board asks for the technical basis of the recommended method. Which explanation identifies the most relevant capability? Some onboarded high-value devices deliberately restrict response actions. Device isolation limits connections while preserving designated Defender communication. File or certificate blocks target future execution independently of host network isolation. Selective isolation is different from unrestricted network reconnection. Explanation Correct Answer C:File or certificate blocks target future execution independently of host network isolation. Incorrect Answers A:Diagnosing why live response is not offered for a high-value device does not prevent a confirmed malicious file from executing on other protected machines. B:Stopping an actively infected workstation communicating broadly with the network while retaining Defender management does not prevent a confirmed malicious file from executing on other protected machines. D:Permitting one critical management application on a contained device where supported does not prevent a confirmed malicious file from executing on other protected machines.
Question 591 One verified malicious executable hash is blocked on a device, but another onboarded machine still runs a renamed copy. Which explanation best accounts for the specific failure? Selective isolation must be supported and explicitly configured; default isolation does not permit arbitrary apps The block indicator is not correctly applied to all targeted devices or the observed hash differs Stopping one process does not establish that remaining malicious artifacts were scanned and cleared Sign-in counts cannot establish high-volume Graph API activity by the consented client Explanation Correct Answer B:The block indicator is not correctly applied to all targeted devices or the observed hash differs. Incorrect Answers A:Selective isolation must be supported and explicitly configured; default isolation does not permit arbitrary apps; the block indicator is not correctly applied to all targeted devices or the observed hash differs. C:Stopping one process does not establish that remaining malicious artifacts were scanned and cleared; the block indicator is not correctly applied to all targeted devices or the observed hash differs. D:Sign-in counts cannot establish high-volume Graph API activity by the consented client; the block indicator is not correctly applied to all targeted devices or the observed hash differs.
Question 592 During a controlled investigation, a supported file block indicator targets a known malware hash across a device group. Which observation most directly verifies the intended technical behavior? Expected management connectivity remains functional while unrelated outbound attempts are blocked The scan's completion and detection/remediation results appear in the device history or Action center Matching file execution is blocked on an in-scope machine and the indicator action is recorded Graph activity by app/principal and endpoint shows the request surge after the consent event Explanation Correct Answer C:Matching file execution is blocked on an in-scope machine and the indicator action is recorded. Incorrect Answers A:Expected management connectivity remains functional while unrelated outbound attempts are blocked; matching file execution is blocked on an in-scope machine and the indicator action is recorded. B:The scan's completion and detection/remediation results appear in the device history or Action center; matching file execution is blocked on an in-scope machine and the indicator action is recorded. D:Graph activity by app/principal and endpoint shows the request surge after the consent event; matching file execution is blocked on an in-scope machine and the indicator action is recorded.
Question 593 A logistics company needs to investigate unexpected Microsoft Graph API calls made by an application. Its current security configuration cannot meet this specific operational requirement. Which action should the SOC implement? Search the supported Microsoft Graph activity logs for app/request information Filter relevant audit activity by principal, event and time window Review Graph request telemetry and returned operation context when available Correlate Graph activity client identity with Entra application and sign-in data Explanation Correct Answer A:Graph activity logs record API activity distinct from ordinary mailbox content. Incorrect Answers B:Audit records support activity reconstruction across applicable workloads. C:Authentication evidence and API resource activity are distinct. D:Principal context establishes which app made the request.
Question 594 The public university SOC needs to investigate unexpected Microsoft Graph API calls made by an application, and its change advisory board asks for the technical basis of the recommended method. Which explanation identifies the most relevant capability? Authentication evidence and API resource activity are distinct. Principal context establishes which app made the request. Audit records support activity reconstruction across applicable workloads. Graph activity logs record API activity distinct from ordinary mailbox content. Explanation Correct Answer D:Graph activity logs record API activity distinct from ordinary mailbox content. Incorrect Answers A:Understanding why a successful Entra sign-in does not prove which Graph data was read does not investigate unexpected Microsoft Graph API calls made by an application. B:Identifying which service principal called a sensitive Graph endpoint does not investigate unexpected Microsoft Graph API calls made by an application. C:Correlating multiple suspicious file downloads by the same user over time does not investigate unexpected Microsoft Graph API calls made by an application.
Question 595 An application signs in successfully to Entra ID, and an investigator claims the app then read a sensitive Graph resource. What evidence is required to substantiate the API-access claim? Graph activity records showing the calling AppId or ServicePrincipalId, RequestUri, method and relevant response context Only an Entra sign-in success code The organization’s Power BI license assignment A generic Windows SecurityEvent logon from an unrelated device Explanation Correct Answer A:Sign-in establishes authentication; Graph activity provides the individual API request identity and URI. Incorrect Answers B:Authentication success does not identify which Graph resource the app requested. C:Power BI licensing is unrelated to a specific Graph API call. D:An endpoint logon for another device does not provide app API requests.
Question 596 An app unexpectedly makes thousands of Microsoft Graph requests to a sensitive endpoint. Which telemetry verifies the API requests and identifies the calling application? Only a successful interactive Entra sign-in is recorded A Purview label was automatically applied to an unrelated document Microsoft Graph activity log records show the relevant AppId or ServicePrincipalId, RequestUri, method, status and time A Defender endpoint process event has no related Graph request context Explanation Correct Answer C:Graph activity logs record API request identity and metadata, unlike sign-in success by itself. Incorrect Answers A:Authentication success does not show each Graph API URI subsequently requested. B:Document labeling does not establish the application’s Graph calls. D:Endpoint process activity without request telemetry cannot confirm the specific Graph API operations.
Question 597 A utility operator needs to identify which service principal called a sensitive Graph endpoint. Its current security configuration cannot meet this specific operational requirement. Which action should the SOC implement? Search the supported Microsoft Graph activity logs for app/request information Correlate Graph activity client identity with Entra application and sign-in data Review Graph request telemetry and returned operation context when available Search the applicable Microsoft Purview Audit events using the resource and activity criteria Explanation Correct Answer B:Principal context establishes which app made the request. Incorrect Answers A:Graph activity logs record API activity distinct from ordinary mailbox content. C:Authentication evidence and API resource activity are distinct. D:Audit searches reconstruct logged operations rather than document content itself.
Question 598 The media company SOC needs to identify which service principal called a sensitive Graph endpoint, and its change advisory board asks for the technical basis of the recommended method. Which explanation identifies the most relevant capability? Principal context establishes which app made the request. Audit log duration does not preserve the underlying mailbox item. Graph activity logs record API activity distinct from ordinary mailbox content. API request patterns help establish the extent of application access. Explanation Correct Answer A:Principal context establishes which app made the request. Incorrect Answers B:Avoiding confusing retention of audit records with retention of messages does not identify which service principal called a sensitive Graph endpoint. C:Investigating unexpected Microsoft Graph API calls made by an application does not identify which service principal called a sensitive Graph endpoint. D:Detecting high-volume calls to a restricted Graph API following suspicious OAuth consent does not identify which service principal called a sensitive Graph endpoint.
Question 599 A Graph API security alert lists an app registration but the investigation attributes calls to a user without checking client application identity. Which explanation best accounts for the specific failure? Graph activity client identity must be correlated with Entra app/service principal context Authentication success does not establish which Microsoft Graph operations or resources were actually requested Sign-in counts cannot establish high-volume Graph API activity by the consented client The audit query is not scoped to a consistent principal and relevant download operation/time window Explanation Correct Answer A:Graph activity client identity must be correlated with Entra app/service principal context. Incorrect Answers B:Authentication success does not establish which Microsoft Graph operations or resources were actually requested. Graph activity client identity must be correlated with Entra app/service principal context. C:Sign-in counts cannot establish high-volume Graph API activity by the consented client. Graph activity client identity must be correlated with Entra app/service principal context. D:The audit query is not scoped to a consistent principal and relevant download operation/time window. Graph activity client identity must be correlated with Entra app/service principal context.
Question 600 During a controlled investigation, a service principal invokes a sensitive Microsoft Graph request. Which observation most directly verifies the intended technical behavior? Graph activity records show the HTTP operation, resource path, caller and result, rather than only the sign-in Graph activity by app/principal and endpoint shows the request surge after the consent event Graph activity records identify the application/client and request path, tied to the Entra service principal The Audit search results return the same actor's matching download operations with timestamps and target files Explanation Correct Answer C:Graph activity records identify the application/client and request path, tied to the Entra service principal. Incorrect Answers A:Graph activity records show the HTTP operation, resource path, caller and result, rather than only the sign-in. Graph activity records identify the application/client and request path, tied to the Entra service principal. B:Graph activity by app/principal and endpoint shows the request surge after the consent event. Graph activity records identify the application/client and request path, tied to the Entra service principal. D:The Audit search results return the same actor's matching download operations with timestamps and target files. Graph activity records identify the application/client and request path, tied to the Entra service principal.
