Question 670 The legal practice SOC needs to identify registry changes to persistence-related keys, and its change advisory board asks for the technical basis of the recommended method. Which explanation identifies the most relevant capability? DeviceFileEvents stores file-system actions distinct from process creation. DeviceRegistryEvents is intended for registry operations on endpoints. DeviceProcessEvents records endpoint process creation telemetry. IdentityLogonEvents captures supported identity authentication activity. Explanation Correct Answer B:DeviceRegistryEvents is intended for registry operations on endpoints. Incorrect Answers A:Finding creation or modification of suspicious files does not identify registry changes to persistence-related keys. C:Querying process launch commands and parent process relationships does not identify registry changes to persistence-related keys. D:Investigating cloud and domain identity authentication behavior does not identify registry changes to persistence-related keys.
Question 671 A Run-key registry value changed but a hunt returns no rows because the query examines only file writes. Which explanation best accounts for the specific failure? The query uses file events rather than the device network event schema Registry persistence changes belong in registry event telemetry, not file write events File modification metadata is in DeviceFileEvents rather than only process creation records Raw identifiers should be enriched from the available identity account or identity information source Explanation Correct Answer B:Registry persistence changes belong in registry event telemetry, not file write events. Incorrect Answers A:The query uses file events rather than the device network event schema. Registry persistence changes belong in registry event telemetry, not file write events. C:File modification metadata is in DeviceFileEvents rather than only process creation records. Registry persistence changes belong in registry event telemetry, not file write events. D:Raw identifiers should be enriched from the available identity account or identity information source. Registry persistence changes belong in registry event telemetry, not file write events.
Question 672 During a controlled investigation, a monitored device adds a known Run-key value for a test process. Which observation most directly verifies the intended technical behavior? DeviceNetworkEvents rows show RemoteIP, RemotePort, device identity and initiating process context DeviceRegistryEvents includes the key path, registry value, action and initiating process DeviceFileEvents includes action, file path and relevant initiating process for that modification An identity enrichment join supplies supported account attributes for the matching identity ID Explanation Correct Answer B:DeviceRegistryEvents includes the key path, registry value, action and initiating process. Incorrect Answers A:DeviceNetworkEvents rows show RemoteIP, RemotePort, device identity and initiating process context. DeviceRegistryEvents includes the key path, registry value, action and initiating process. C:DeviceFileEvents includes action, file path and relevant initiating process for that modification. DeviceRegistryEvents includes the key path, registry value, action and initiating process. D:An identity enrichment join supplies supported account attributes for the matching identity ID. DeviceRegistryEvents includes the key path, registry value, action and initiating process.
Question 673 A utility operator needs to investigate cloud and domain identity authentication behavior. Its current security configuration cannot meet this specific operational requirement. Which action should the SOC implement? Use IdentityLogonEvents with action and principal details Use DeviceRegistryEvents with key path and value fields Use IdentityDirectoryEvents for relevant directory event activity Use identity account or identity info tables as available for enrichment Explanation Correct Answer A:IdentityLogonEvents captures supported identity authentication activity. Incorrect Answers B:DeviceRegistryEvents is intended for registry operations on endpoints. C:IdentityDirectoryEvents covers supported domain-controller-related activities. D:Identity inventory helps annotate observed events but does not prove malicious action itself.
Question 674 The media company SOC needs to investigate cloud and domain identity authentication behavior, and its change advisory board asks for the technical basis of the recommended method. Which explanation identifies the most relevant capability? extend adds a derived column without replacing the source event. Directory object lookup telemetry is distinct from authentication. IdentityLogonEvents captures supported identity authentication activity. Identity inventory helps annotate observed events but does not prove malicious action itself. Explanation Correct Answer C:IdentityLogonEvents captures supported identity authentication activity. Incorrect Answers A:Creating a derived indicator of suspicious-port usage from a numeric port field does not investigate cloud and domain identity authentication behavior. B:Investigating suspicious queries for directory objects by an account does not investigate cloud and domain identity authentication behavior. D:Examining inventory context for an identity referenced in other hunting events does not investigate cloud and domain identity authentication behavior.
Question 675 A Defender hunting query on IdentityLogonEvents returns no results despite visible sign-in records in Entra. A colleague assumes the SQL syntax is necessarily wrong. What scope issue must be checked? Whether the relevant Defender identity service feeds and supported event coverage populate that hunting table Whether all users have the Sentinel Playbook Operator role Whether Microsoft Defender endpoint antivirus signatures are exactly equal on all PCs Whether the eDiscovery hold query includes the same custodian Explanation Correct Answer A:Different identity data sources and product deployment conditions determine which identity events appear in Defender hunting tables. Incorrect Answers B:Playbook permissions do not cause identity hunting records to populate. C:Endpoint signatures are not the identity telemetry onboarding prerequisite. D:eDiscovery custodian scope is unrelated to Defender hunting table coverage.
Question 676 An identity analyst hunts unexpected authentication across on-premises and cloud contexts. What result would show that the chosen Defender hunting table is appropriate? EmailAttachmentInfo returns attachment hash metadata only DeviceFileEvents returns local file creation paths DeviceRegistryEvents returns modifications to Windows registry keys IdentityLogonEvents returns logon activity with relevant identity, action and authentication context Explanation Correct Answer D:IdentityLogonEvents is intended for supported identity logon activity, unlike endpoint file and registry telemetry. Incorrect Answers A:Email attachment metadata does not establish account authentication. B:File creation rows are not identity logon records. C:Registry modifications can aid endpoint investigations but do not directly report identity sign-ins.
Question 677 A legal practice needs to investigate suspicious queries for directory objects by an account. Its current security configuration cannot meet this specific operational requirement. Which action should the SOC implement? Use DeviceProcessEvents with relevant process and initiating process columns Use IdentityDirectoryEvents for relevant directory event activity Query IdentityQueryEvents by relevant directory query fields Use identity account or identity info tables as available for enrichment Explanation Correct Answer C:Directory object lookup telemetry is distinct from authentication. Incorrect Answers A:DeviceProcessEvents records endpoint process creation telemetry. B:IdentityDirectoryEvents covers supported domain-controller-related activities. D:Identity inventory helps annotate observed events but does not prove malicious action itself.
Question 678 The government contractor SOC needs to investigate suspicious queries for directory objects by an account, and its change advisory board asks for the technical basis of the recommended method. Which explanation identifies the most relevant capability? IdentityLogonEvents captures supported identity authentication activity. IdentityDirectoryEvents covers supported domain-controller-related activities. ago computes a relative datetime cutoff for event records. Directory object lookup telemetry is distinct from authentication. Explanation Correct Answer D:Directory object lookup telemetry is distinct from authentication. Incorrect Answers A:Investigating cloud and domain identity authentication behavior does not investigate suspicious queries for directory objects by an account. B:Finding on-premises Active Directory changes performed against domain controllers does not investigate suspicious queries for directory objects by an account. C:Restricting a Defender hunting query to the most recent two hours does not investigate suspicious queries for directory objects by an account.
Question 679 A directory reconnaissance alert is being analyzed using only endpoint network events with no LDAP or identity query details. Which explanation best accounts for the specific failure? Directory object modifications are not the same as authentication events Network traffic alone lacks the identity-directory query information needed for a source-grounded investigation Raw identifiers should be enriched from the available identity account or identity information source A URL embedded in email is not evidence of recipient interaction Explanation Correct Answer B:Network traffic alone lacks the identity-directory query information needed for a source-grounded investigation. Incorrect Answers A:Directory object modifications are not the same as authentication events. Network traffic alone lacks the identity-directory query information needed for a source-grounded investigation. C:Raw identifiers should be enriched from the available identity account or identity information source. Network traffic alone lacks the identity-directory query information needed for a source-grounded investigation. D:A URL embedded in email is not evidence of recipient interaction. Network traffic alone lacks the identity-directory query information needed for a source-grounded investigation.
Question 680 During a controlled investigation, a test account performs suspicious queries of Active Directory objects. Which observation most directly verifies the intended technical behavior? IdentityQueryEvents shows the initiating identity and directory query activity where supported IdentityDirectoryEvents identifies the directory action, object and actor context An identity enrichment join supplies supported account attributes for the matching identity ID UrlClickEvents contains the matching user, URL and click time Explanation Correct Answer A:IdentityQueryEvents shows the initiating identity and directory query activity where supported. Incorrect Answers B:IdentityDirectoryEvents identifies the directory action, object and actor context. IdentityQueryEvents shows the initiating identity and directory query activity where supported. C:An identity enrichment join supplies supported account attributes for the matching identity ID. IdentityQueryEvents shows the initiating identity and directory query activity where supported. D:UrlClickEvents contains the matching user, URL and click time. IdentityQueryEvents shows the initiating identity and directory query activity where supported.
