Question 600 During a controlled investigation, a service principal invokes a sensitive Microsoft Graph request. Which observation most directly verifies the intended technical behavior? Graph activity records show the HTTP operation, resource path, caller and result, rather than only the sign-in Graph activity by app/principal and endpoint shows the request surge after the consent event Graph activity records identify the application/client and request path, tied to the Entra service principal The Audit search results return the same actor's matching download operations with timestamps and target files Explanation Correct Answer C:Graph activity records identify the application/client and request path, tied to the Entra service principal. Incorrect Answers A:Graph activity records show the HTTP operation, resource path, caller and result, rather than only the sign-in. Graph activity records identify the application/client and request path, tied to the Entra service principal. B:Graph activity by app/principal and endpoint shows the request surge after the consent event. Graph activity records identify the application/client and request path, tied to the Entra service principal. D:The Audit search results return the same actor's matching download operations with timestamps and target files. Graph activity records identify the application/client and request path, tied to the Entra service principal.
Question 601 A legal practice needs to understand why a successful Entra sign-in does not prove which Graph data was read. Its current security configuration cannot meet this specific operational requirement. Which action should the SOC implement? Review Graph request telemetry and returned operation context when available Use scoped sources and search query filters in eDiscovery Search the supported Microsoft Graph activity logs for app/request information Correlate Graph activity client identity with Entra application and sign-in data Explanation Correct Answer A:Authentication evidence and API resource activity are distinct. Incorrect Answers B:Appropriate scope reduces unrelated private data and improves review. C:Graph activity logs record API activity distinct from ordinary mailbox content. D:Principal context establishes which app made the request.
Question 602 The government contractor SOC needs to understand why a successful Entra sign-in does not prove which Graph data was read, and its change advisory board asks for the technical basis of the recommended method. Which explanation identifies the most relevant capability? Authentication evidence and API resource activity are distinct. Content search finds eligible stored items rather than merely listing activity events. API request patterns help establish the extent of application access. Principal context establishes which app made the request. Explanation Correct Answer A:Authentication evidence and API resource activity are distinct. Incorrect Answers B:Finding relevant retained communications for an authorized insider investigation does not understand why a successful Entra sign-in does not prove which Graph data was read. C:Detecting high-volume calls to a restricted Graph API following suspicious OAuth consent does not understand why a successful Entra sign-in does not prove which Graph data was read. D:Identifying which service principal called a sensitive Graph endpoint does not understand why a successful Entra sign-in does not prove which Graph data was read.
Question 603 A user signs in successfully, but the team claims this proves an external app downloaded mailbox data; there is no Graph request activity in the evidence. Which explanation best accounts for the specific failure? Authentication success does not establish which Microsoft Graph operations or resources were actually requested Graph activity client identity must be correlated with Entra app/service principal context Sign-in counts cannot establish high-volume Graph API activity by the consented client Authentication records do not show the Exchange mailbox rule-creation operation Explanation Correct Answer A:Authentication success does not establish which Microsoft Graph operations or resources were actually requested. Incorrect Answers B:Graph activity client identity must be correlated with Entra app/service principal context; authentication success does not establish which Microsoft Graph operations or resources were actually requested. C:Sign-in counts cannot establish high-volume Graph API activity by the consented client; authentication success does not establish which Microsoft Graph operations or resources were actually requested. D:Authentication records do not show the Exchange mailbox rule-creation operation; authentication success does not establish which Microsoft Graph operations or resources were actually requested.
Question 604 During a controlled investigation, an application performs a known Microsoft Graph read following authentication. Which observation most directly verifies the intended technical behavior? Graph activity records identify the application/client and request path, tied to the Entra service principal Graph activity by app/principal and endpoint shows the request surge after the consent event An applicable mailbox audit event records the rule operation, actor and time Graph activity records show the HTTP operation, resource path, caller and result, rather than only the sign-in Explanation Correct Answer D:Graph activity records show the HTTP operation, resource path, caller and result, rather than only the sign-in. Incorrect Answers A:Graph activity records identify the application/client and request path, tied to the Entra service principal. Graph activity records show the HTTP operation, resource path, caller and result, rather than only the sign-in. B:Graph activity by app/principal and endpoint shows the request surge after the consent event. Graph activity records show the HTTP operation, resource path, caller and result, rather than only the sign-in. C:An applicable mailbox audit event records the rule operation, actor and time. Graph activity records show the HTTP operation, resource path, caller and result, rather than only the sign-in.
Question 605 A hospital SOC needs to detect high-volume calls to a restricted Graph API following suspicious OAuth consent. Its current security configuration cannot meet this specific operational requirement. Which action should the SOC implement? Review Graph request telemetry and returned operation context when available Search the supported Microsoft Graph activity logs for app/request information Use eDiscovery for eligible content and Audit for the deletion activity Hunt Graph activity by principal, request path and time after the consent event Explanation Correct Answer D:API request patterns help establish the extent of application access. Incorrect Answers A:Authentication evidence and API resource activity are distinct. B:Graph activity logs record API activity distinct from ordinary mailbox content. C:Content and activity evidence answer different investigative questions.
Question 606 The financial services SOC SOC needs to detect high-volume calls to a restricted Graph API following suspicious OAuth consent, and its change advisory board asks for the technical basis of the recommended method. Which explanation identifies the most relevant capability? Authentication evidence and API resource activity are distinct. Audit records support activity reconstruction across applicable workloads. API request patterns help establish the extent of application access. Principal context establishes which app made the request. Explanation Correct Answer C:API request patterns help establish the extent of application access. Incorrect Answers A:Understanding why a successful Entra sign-in does not prove which Graph data was read does not detect high-volume calls to a restricted Graph API following suspicious OAuth consent. B:Correlating multiple suspicious file downloads by the same user over time does not detect high-volume calls to a restricted Graph API following suspicious OAuth consent. D:Identifying which service principal called a sensitive Graph endpoint does not detect high-volume calls to a restricted Graph API following suspicious OAuth consent.
Question 607 A suspicious OAuth consent grant is followed by reported API scraping, but the team checks only Entra sign-in count and not Graph request volume. Which explanation best accounts for the specific failure? Graph activity client identity must be correlated with Entra app/service principal context Authentication success does not establish which Microsoft Graph operations or resources were actually requested Audit event retention is separate from retaining the underlying mailbox content Sign-in counts cannot establish high-volume Graph API activity by the consented client Explanation Correct Answer D:Sign-in counts cannot establish high-volume Graph API activity by the consented client. Incorrect Answers A:Graph activity client identity must be correlated with Entra app/service principal context. Sign-in counts cannot establish high-volume Graph API activity by the consented client. B:Authentication success does not establish which Microsoft Graph operations or resources were actually requested. Sign-in counts cannot establish high-volume Graph API activity by the consented client. C:Audit event retention is separate from retaining the underlying mailbox content. Sign-in counts cannot establish high-volume Graph API activity by the consented client.
Question 608 During a controlled investigation, a consented app makes an abnormal volume of supported Graph requests in a time window. Which observation most directly verifies the intended technical behavior? Graph activity records identify the application/client and request path, tied to the Entra service principal Graph activity records show the HTTP operation, resource path, caller and result, rather than only the sign-in Audit still records the deletion event; content remains discoverable only when relevant retention or hold applies Graph activity by app/principal and endpoint shows the request surge after the consent event Explanation Correct Answer D:Graph activity by app/principal and endpoint shows the request surge after the consent event. Incorrect Answers A:Graph activity records identify the application/client and request path, tied to the Entra service principal. Graph activity by app/principal and endpoint shows the request surge after the consent event. B:Graph activity records show the HTTP operation, resource path, caller and result, rather than only the sign-in. Graph activity by app/principal and endpoint shows the request surge after the consent event. C:Audit still records the deletion event; content remains discoverable only when relevant retention or hold applies. Graph activity by app/principal and endpoint shows the request surge after the consent event.
Question 609 A government contractor needs to identify who deleted a sensitive SharePoint document and when. Its current security configuration cannot meet this specific operational requirement. Which action should the SOC implement? Search the applicable Microsoft Purview Audit events using the resource and activity criteria Examine applicable Exchange mailbox audit operations and timestamps Evaluate Audit log retention separately from content preservation policies Hunt Graph activity by principal, request path and time after the consent event Explanation Correct Answer A:Audit searches reconstruct logged operations rather than document content itself. Incorrect Answers B:Mailbox rule changes can be investigated through audit activity. C:Audit log duration does not preserve the underlying mailbox item. D:API request patterns help establish the extent of application access.
Question 610 The insurance provider SOC needs to identify who deleted a sensitive SharePoint document and when, and its change advisory board asks for the technical basis of the recommended method. Which explanation identifies the most relevant capability? Audit searches reconstruct logged operations rather than document content itself. Appropriate scope reduces unrelated private data and improves review. Audit log duration does not preserve the underlying mailbox item. Audit records support activity reconstruction across applicable workloads. Explanation Correct Answer A:Audit searches reconstruct logged operations rather than document content itself. Incorrect Answers B:Narrowing a large evidence search to relevant custodians and date ranges does not identify who deleted a sensitive SharePoint document and when. C:Avoiding confusing retention of audit records with retention of messages does not identify who deleted a sensitive SharePoint document and when. D:Correlating multiple suspicious file downloads by the same user over time does not identify who deleted a sensitive SharePoint document and when.
