Practice Exams:

View All

Microsoft SC-200 Defender Evidence Entity Investigation And Attack Disruption Remediation Practice Test

Skills 2.2 • 35 original questions

This Microsoft SC-200 Security Operations Analyst practice test focuses on defender evidence entity investigation and attack disruption remediation through original scenario-based questions aligned to the skills measured as of July 28, 2026. Use the full ExamSnap SC-200 collection for broader practice across the current Defender XDR, Microsoft Sentinel, incident-response, and threat-hunting skill areas. For broader exam preparation, review the Microsoft SC-200 Exam Dumps page.

Instructions: Select the best answer for each question. Review the explanation after answering; each distractor includes a reason it is not the best choice for that scenario.

Question 1

During a audit investigation at A. Datum, the Sentinel administrator must trace the incident through related evidence and entities to determine scope and affected assets. Which action most directly satisfies the requirement for the privileged-users group, response wave 1? The design priority is to preserve least privilege.

Pivot through Defender evidence and entity pages to validate the affected files, processes, users, devices, and related indicators
Review the Microsoft Defender for Endpoint device timeline for the affected endpoint and time window
Correlate the incident across identities, endpoints, cloud resources, and other affected domains to reconstruct the attack sequence and lateral movement
Use Microsoft Purview eDiscovery Content search to locate the relevant messages, files, or other discoverable Microsoft 365 content
Use the embedded Microsoft Security Copilot or agentic investigation capability to summarize, analyze, and accelerate the incident investigation

Correct answer: A

Why: Evidence and entity investigation connects artifacts and identities to the incident so analysts can validate scope, relationships, and remediation targets. This directly addresses the requirement: trace the incident through related evidence and entities to determine scope and affected assets.

Option review:

A: Evidence and entity investigation connects artifacts and identities to the incident so analysts can validate scope, relationships, and remediation targets. This directly addresses the requirement: trace the incident through related evidence and entities to determine scope and affected assets.

B: The device timeline provides chronological endpoint events and alerts so analysts can reconstruct process, file, network, registry, and user activity around the incident. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: trace the incident through related evidence and entities to determine scope and affected assets.

C: Complex attacks span multiple stages or security domains, so the analyst must connect related evidence and entity activity rather than investigating each alert in isolation. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: trace the incident through related evidence and entities to determine scope and affected assets.

D: Content search is designed to find content across supported Microsoft 365 locations using investigation criteria and is appropriate when the analyst needs the actual discoverable content. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: trace the incident through related evidence and entities to determine scope and affected assets.

E: Security Copilot can synthesize incident context, explain security data, and assist analysts while the analyst remains responsible for validating evidence and response decisions. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: trace the incident through related evidence and entities to determine scope and affected assets.

Learning point: Pivot through Defender evidence and entity pages to validate the affected files, processes, users, devices, and related indicators

Question 2

Contoso Health is revising its SOC runbook after a SOC tuning initiative. Analysts need to review and complete remediation after automatic attack disruption has contained part of an attack. Which implementation should the security engineer select for the server fleet, response wave 1 while trying to reduce mean time to respond?

Use Microsoft Defender for Identity alert and entity context to investigate the suspicious identity activity and remediate the affected account or infrastructure
Pivot through Defender evidence and entity pages to validate the affected files, processes, users, devices, and related indicators
Use the incident case-management fields and workflow to assign ownership, document status, track evidence, and coordinate response
Review the automatic attack disruption actions and incident evidence, then validate or complete the required remediation
Investigate the Microsoft Entra ID identity risk and remediate the compromised account using the appropriate identity-protection action

Correct answer: D

Why: Attack disruption may automatically contain affected assets during an active attack, but analysts still need to review the incident and complete or validate remediation. This directly addresses the requirement: review and complete remediation after automatic attack disruption has contained part of an attack.

Option review:

A: Defender for Identity correlates identity and directory activity to detect suspicious behavior in identity infrastructure and provides entity context for investigation. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: review and complete remediation after automatic attack disruption has contained part of an attack.

B: Evidence and entity investigation connects artifacts and identities to the incident so analysts can validate scope, relationships, and remediation targets. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: review and complete remediation after automatic attack disruption has contained part of an attack.

C: Case management provides the operational structure for ownership, status, comments, tasks, and collaboration throughout the incident lifecycle. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: review and complete remediation after automatic attack disruption has contained part of an attack.

D: Attack disruption may automatically contain affected assets during an active attack, but analysts still need to review the incident and complete or validate remediation. This directly addresses the requirement: review and complete remediation after automatic attack disruption has contained part of an attack.

E: Microsoft Entra ID risk detections and identity-protection controls are the primary source for investigating compromised identities and enforcing identity remediation. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: review and complete remediation after automatic attack disruption has contained part of an attack.

Learning point: Review the automatic attack disruption actions and incident evidence, then validate or complete the required remediation

Question 3

A ticket escalated to the security operations analyst at Adventure Works states one non-negotiable goal: trace the incident through related evidence and entities to determine scope and affected assets. Which choice is the strongest fit for the production subscription, response wave 2? The team also wants to reduce mean time to respond.

Query Microsoft Graph activity logs to investigate the application or API activity associated with the suspected threat
Review the Microsoft Defender for Endpoint device timeline for the affected endpoint and time window
Correlate the incident across identities, endpoints, cloud resources, and other affected domains to reconstruct the attack sequence and lateral movement
Investigate the Microsoft Entra ID identity risk and remediate the compromised account using the appropriate identity-protection action
Pivot through Defender evidence and entity pages to validate the affected files, processes, users, devices, and related indicators

Correct answer: E

Option review:

A: Microsoft Graph activity logs provide request-level visibility into Graph API activity and are appropriate when the investigation centers on application or API access to Microsoft 365 data. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: trace the incident through related evidence and entities to determine scope and affected assets.

D: Microsoft Entra ID risk detections and identity-protection controls are the primary source for investigating compromised identities and enforcing identity remediation. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: trace the incident through related evidence and entities to determine scope and affected assets.

E: Evidence and entity investigation connects artifacts and identities to the incident so analysts can validate scope, relationships, and remediation targets. This directly addresses the requirement: trace the incident through related evidence and entities to determine scope and affected assets.

Learning point: Pivot through Defender evidence and entity pages to validate the affected files, processes, users, devices, and related indicators

Question 4

For the research subscription, response wave 2 at Proseware Services, a cloud-workload incident can proceed only if the team can review and complete remediation after automatic attack disruption has contained part of an attack. What should the Sentinel administrator configure first if the operational goal is to scope the change to the affected security domain?

Review the automatic attack disruption actions and incident evidence, then validate or complete the required remediation
Use the appropriate Defender for Endpoint device action, such as live response or collection of an investigation package
Use Microsoft Purview eDiscovery Content search to locate the relevant messages, files, or other discoverable Microsoft 365 content
Use Microsoft Defender for Identity alert and entity context to investigate the suspicious identity activity and remediate the affected account or infrastructure
Use the incident case-management fields and workflow to assign ownership, document status, track evidence, and coordinate response

Correct answer: A

Option review:

A: Attack disruption may automatically contain affected assets during an active attack, but analysts still need to review the incident and complete or validate remediation. This directly addresses the requirement: review and complete remediation after automatic attack disruption has contained part of an attack.

B: Live response supports remote investigation and command execution on supported endpoints, while investigation packages collect endpoint artifacts for deeper analysis. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: review and complete remediation after automatic attack disruption has contained part of an attack.

C: Content search is designed to find content across supported Microsoft 365 locations using investigation criteria and is appropriate when the analyst needs the actual discoverable content. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: review and complete remediation after automatic attack disruption has contained part of an attack.

D: Defender for Identity correlates identity and directory activity to detect suspicious behavior in identity infrastructure and provides entity context for investigation. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: review and complete remediation after automatic attack disruption has contained part of an attack.

E: Case management provides the operational structure for ownership, status, comments, tasks, and collaboration throughout the incident lifecycle. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: review and complete remediation after automatic attack disruption has contained part of an attack.

Learning point: Review the automatic attack disruption actions and incident evidence, then validate or complete the required remediation

Question 5

The security architecture review at Wide World Importers focuses on this requirement: trace the incident through related evidence and entities to determine scope and affected assets. Which Microsoft security action is most appropriate for the Tier 1 queue, response wave 3, given the need to scope the change to the affected security domain?

Use Microsoft Defender for Identity alert and entity context to investigate the suspicious identity activity and remediate the affected account or infrastructure
Review the automatic attack disruption actions and incident evidence, then validate or complete the required remediation
Use Microsoft Purview eDiscovery Content search to locate the relevant messages, files, or other discoverable Microsoft 365 content
Search Microsoft Purview Audit for the relevant user, admin, file, or service activity during the investigation window
Pivot through Defender evidence and entity pages to validate the affected files, processes, users, devices, and related indicators

Correct answer: E

Option review:

A: Defender for Identity correlates identity and directory activity to detect suspicious behavior in identity infrastructure and provides entity context for investigation. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: trace the incident through related evidence and entities to determine scope and affected assets.

B: Attack disruption may automatically contain affected assets during an active attack, but analysts still need to review the incident and complete or validate remediation. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: trace the incident through related evidence and entities to determine scope and affected assets.

C: Content search is designed to find content across supported Microsoft 365 locations using investigation criteria and is appropriate when the analyst needs the actual discoverable content. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: trace the incident through related evidence and entities to determine scope and affected assets.

D: Purview Audit provides searchable Microsoft 365 audit events that help analysts establish who performed an action, on which object, and when. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: trace the incident through related evidence and entities to determine scope and affected assets.

Learning point: Pivot through Defender evidence and entity pages to validate the affected files, processes, users, devices, and related indicators

Question 6

A change advisory board at Wingtip Toys asks how to review and complete remediation after automatic attack disruption has contained part of an attack during a identity compromise review. Which proposed action should the security operations analyst approve for the Tier 2 queue, response wave 3? The change should keep the workflow auditable.

Pivot through Defender evidence and entity pages to validate the affected files, processes, users, devices, and related indicators
Use Microsoft Purview eDiscovery Content search to locate the relevant messages, files, or other discoverable Microsoft 365 content
Investigate the Microsoft Entra ID identity risk and remediate the compromised account using the appropriate identity-protection action
Review the automatic attack disruption actions and incident evidence, then validate or complete the required remediation
Use Microsoft Defender for Office 365 investigation and remediation actions for the malicious message, campaign, or collaboration threat

Correct answer: D

Option review:

A: Evidence and entity investigation connects artifacts and identities to the incident so analysts can validate scope, relationships, and remediation targets. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: review and complete remediation after automatic attack disruption has contained part of an attack.

B: Content search is designed to find content across supported Microsoft 365 locations using investigation criteria and is appropriate when the analyst needs the actual discoverable content. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: review and complete remediation after automatic attack disruption has contained part of an attack.

C: Microsoft Entra ID risk detections and identity-protection controls are the primary source for investigating compromised identities and enforcing identity remediation. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: review and complete remediation after automatic attack disruption has contained part of an attack.

E: Defender for Office 365 provides message, campaign, and entity investigation with remediation actions and can participate in coordinated attack disruption for eligible attacks. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: review and complete remediation after automatic attack disruption has contained part of an attack.

Learning point: Review the automatic attack disruption actions and incident evidence, then validate or complete the required remediation

Question 7

Northwind Traders has ruled out a manual one-off workaround. For the endpoint-response team, response wave 4, the remaining requirement is to trace the incident through related evidence and entities to determine scope and affected assets. Which choice best addresses it and helps keep the workflow auditable?

Use Microsoft Purview eDiscovery Content search to locate the relevant messages, files, or other discoverable Microsoft 365 content
Pivot through Defender evidence and entity pages to validate the affected files, processes, users, devices, and related indicators
Use Microsoft Defender for Office 365 investigation and remediation actions for the malicious message, campaign, or collaboration threat
Use Microsoft Defender for Cloud workload-protection alerts and recommendations to investigate and remediate the affected cloud resource
Use Microsoft Defender for Identity alert and entity context to investigate the suspicious identity activity and remediate the affected account or infrastructure

Correct answer: B

Option review:

A: Content search is designed to find content across supported Microsoft 365 locations using investigation criteria and is appropriate when the analyst needs the actual discoverable content. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: trace the incident through related evidence and entities to determine scope and affected assets.

B: Evidence and entity investigation connects artifacts and identities to the incident so analysts can validate scope, relationships, and remediation targets. This directly addresses the requirement: trace the incident through related evidence and entities to determine scope and affected assets.

C: Defender for Office 365 provides message, campaign, and entity investigation with remediation actions and can participate in coordinated attack disruption for eligible attacks. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: trace the incident through related evidence and entities to determine scope and affected assets.

D: Defender for Cloud workload protections surface resource-specific security alerts and context for cloud workloads so the SOC can investigate and remediate the affected resource. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: trace the incident through related evidence and entities to determine scope and affected assets.

E: Defender for Identity correlates identity and directory activity to detect suspicious behavior in identity infrastructure and provides entity context for investigation. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: trace the incident through related evidence and entities to determine scope and affected assets.

Learning point: Pivot through Defender evidence and entity pages to validate the affected files, processes, users, devices, and related indicators

Question 8

During post-incident review at Tailspin Toys, the incident responder identifies a gap: the SOC still needs to review and complete remediation after automatic attack disruption has contained part of an attack. Which action should be added for the cloud-security team, response wave 4 before the next incident, with an emphasis on trying to avoid changing an unrelated control plane?

Use the embedded Microsoft Security Copilot or agentic investigation capability to summarize, analyze, and accelerate the incident investigation
Review the Microsoft Defender for Endpoint device timeline for the affected endpoint and time window
Open and investigate the Microsoft Sentinel incident, review its entities and evidence, and perform the required remediation workflow
Review the automatic attack disruption actions and incident evidence, then validate or complete the required remediation
Use Microsoft Defender for Cloud workload-protection alerts and recommendations to investigate and remediate the affected cloud resource

Correct answer: D

Option review:

A: Security Copilot can synthesize incident context, explain security data, and assist analysts while the analyst remains responsible for validating evidence and response decisions. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: review and complete remediation after automatic attack disruption has contained part of an attack.

B: The device timeline provides chronological endpoint events and alerts so analysts can reconstruct process, file, network, registry, and user activity around the incident. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: review and complete remediation after automatic attack disruption has contained part of an attack.

C: Sentinel incidents aggregate alerts and related entities into a case for triage, investigation, assignment, status tracking, and response. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: review and complete remediation after automatic attack disruption has contained part of an attack.

E: Defender for Cloud workload protections surface resource-specific security alerts and context for cloud workloads so the SOC can investigate and remediate the affected resource. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: review and complete remediation after automatic attack disruption has contained part of an attack.

Learning point: Review the automatic attack disruption actions and incident evidence, then validate or complete the required remediation

Question 9

The SOC analyst at Blue Yonder Airlines is comparing several Microsoft security options for a endpoint containment exercise. Which one directly enables the team to trace the incident through related evidence and entities to determine scope and affected assets for the night shift, response wave 5 while helping avoid changing an unrelated control plane?

Query Microsoft Graph activity logs to investigate the application or API activity associated with the suspected threat
Search Microsoft Purview Audit for the relevant user, admin, file, or service activity during the investigation window
Pivot through Defender evidence and entity pages to validate the affected files, processes, users, devices, and related indicators
Use the relevant Microsoft Purview investigation experience and remediation workflow for the identified risky or compromised entity
Use Microsoft Defender for Cloud workload-protection alerts and recommendations to investigate and remediate the affected cloud resource

Correct answer: C

Option review:

B: Purview Audit provides searchable Microsoft 365 audit events that help analysts establish who performed an action, on which object, and when. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: trace the incident through related evidence and entities to determine scope and affected assets.

C: Evidence and entity investigation connects artifacts and identities to the incident so analysts can validate scope, relationships, and remediation targets. This directly addresses the requirement: trace the incident through related evidence and entities to determine scope and affected assets.

D: Purview surfaces data-governance and insider/compliance signals that can identify risky activity or entities requiring investigation and policy-driven remediation. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: trace the incident through related evidence and entities to determine scope and affected assets.

E: Defender for Cloud workload protections surface resource-specific security alerts and context for cloud workloads so the SOC can investigate and remediate the affected resource. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: trace the incident through related evidence and entities to determine scope and affected assets.

Learning point: Pivot through Defender evidence and entity pages to validate the affected files, processes, users, devices, and related indicators

Question 10

A security-operations workshop at Trey Research defines the desired outcome as follows: review and complete remediation after automatic attack disruption has contained part of an attack. Which implementation should be chosen for the EMEA SOC, response wave 5? The team wants to improve detection coverage.

Review the automatic attack disruption actions and incident evidence, then validate or complete the required remediation
Use the appropriate Defender for Endpoint device action, such as live response or collection of an investigation package
Use Microsoft Defender for Cloud workload-protection alerts and recommendations to investigate and remediate the affected cloud resource
Review the Microsoft Defender for Endpoint device timeline for the affected endpoint and time window
Use the relevant Microsoft Purview investigation experience and remediation workflow for the identified risky or compromised entity

Correct answer: A

Option review:

C: Defender for Cloud workload protections surface resource-specific security alerts and context for cloud workloads so the SOC can investigate and remediate the affected resource. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: review and complete remediation after automatic attack disruption has contained part of an attack.

D: The device timeline provides chronological endpoint events and alerts so analysts can reconstruct process, file, network, registry, and user activity around the incident. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: review and complete remediation after automatic attack disruption has contained part of an attack.

E: Purview surfaces data-governance and insider/compliance signals that can identify risky activity or entities requiring investigation and policy-driven remediation. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: review and complete remediation after automatic attack disruption has contained part of an attack.

Learning point: Review the automatic attack disruption actions and incident evidence, then validate or complete the required remediation

Question 11

Which Microsoft security action best matches this technical purpose for the high-value-assets group, response wave 6: Evidence and entity investigation connects artifacts and identities to the incident so analysts can validate scope, relationships, and remediation targets. The SOC is trying to improve detection coverage.

Pivot through Defender evidence and entity pages to validate the affected files, processes, users, devices, and related indicators
Review the automatic attack disruption actions and incident evidence, then validate or complete the required remediation
Review the Microsoft Defender for Endpoint device timeline for the affected endpoint and time window
Query Microsoft Graph activity logs to investigate the application or API activity associated with the suspected threat
Use the incident case-management fields and workflow to assign ownership, document status, track evidence, and coordinate response

Correct answer: A

Option review:

C: The device timeline provides chronological endpoint events and alerts so analysts can reconstruct process, file, network, registry, and user activity around the incident. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: trace the incident through related evidence and entities to determine scope and affected assets.

D: Microsoft Graph activity logs provide request-level visibility into Graph API activity and are appropriate when the investigation centers on application or API access to Microsoft 365 data. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: trace the incident through related evidence and entities to determine scope and affected assets.

E: Case management provides the operational structure for ownership, status, comments, tasks, and collaboration throughout the incident lifecycle. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: trace the incident through related evidence and entities to determine scope and affected assets.

Learning point: Pivot through Defender evidence and entity pages to validate the affected files, processes, users, devices, and related indicators

Question 12

An analyst at Litware Manufacturing describes the needed capability this way: Attack disruption may automatically contain affected assets during an active attack, but analysts still need to review the incident and complete or validate remediation. Which option should be associated with that requirement for the privileged-users group, response wave 6 while the team tries to support repeatable response?

Review the automatic attack disruption actions and incident evidence, then validate or complete the required remediation
Use the appropriate Defender for Endpoint device action, such as live response or collection of an investigation package
Query Microsoft Graph activity logs to investigate the application or API activity associated with the suspected threat
Use the relevant Microsoft Purview investigation experience and remediation workflow for the identified risky or compromised entity
Use Microsoft Defender for Cloud Apps to investigate the risky cloud-app activity and apply the appropriate session, user, file, or app remediation

Correct answer: A

Option review:

C: Microsoft Graph activity logs provide request-level visibility into Graph API activity and are appropriate when the investigation centers on application or API access to Microsoft 365 data. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: review and complete remediation after automatic attack disruption has contained part of an attack.

D: Purview surfaces data-governance and insider/compliance signals that can identify risky activity or entities requiring investigation and policy-driven remediation. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: review and complete remediation after automatic attack disruption has contained part of an attack.

E: Defender for Cloud Apps provides cloud-app activity, risk, governance, and control context that is appropriate for investigating risky SaaS usage and entities. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: review and complete remediation after automatic attack disruption has contained part of an attack.

Learning point: Review the automatic attack disruption actions and incident evidence, then validate or complete the required remediation

Question 13

During a design validation for the remote-user fleet, response wave 7, Proseware Services documents the following behavior: Evidence and entity investigation connects artifacts and identities to the incident so analysts can validate scope, relationships, and remediation targets. Which Microsoft security feature or action is being described? The objective is to support repeatable response.

Review the Microsoft Defender for Endpoint device timeline for the affected endpoint and time window
Pivot through Defender evidence and entity pages to validate the affected files, processes, users, devices, and related indicators
Use the relevant Microsoft Purview investigation experience and remediation workflow for the identified risky or compromised entity
Use the incident case-management fields and workflow to assign ownership, document status, track evidence, and coordinate response
Use Microsoft Defender for Office 365 investigation and remediation actions for the malicious message, campaign, or collaboration threat

Correct answer: B

Option review:

A: The device timeline provides chronological endpoint events and alerts so analysts can reconstruct process, file, network, registry, and user activity around the incident. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: trace the incident through related evidence and entities to determine scope and affected assets.

C: Purview surfaces data-governance and insider/compliance signals that can identify risky activity or entities requiring investigation and policy-driven remediation. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: trace the incident through related evidence and entities to determine scope and affected assets.

D: Case management provides the operational structure for ownership, status, comments, tasks, and collaboration throughout the incident lifecycle. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: trace the incident through related evidence and entities to determine scope and affected assets.

E: Defender for Office 365 provides message, campaign, and entity investigation with remediation actions and can participate in coordinated attack disruption for eligible attacks. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: trace the incident through related evidence and entities to determine scope and affected assets.

Learning point: Pivot through Defender evidence and entity pages to validate the affected files, processes, users, devices, and related indicators

Question 14

The threat hunter must identify the Microsoft security capability that provides this function for the production subscription, response wave 7: Attack disruption may automatically contain affected assets during an active attack, but analysts still need to review the incident and complete or validate remediation. Which choice is correct if the SOC also needs to separate collection from detection logic?

Investigate the Microsoft Entra ID identity risk and remediate the compromised account using the appropriate identity-protection action
Use the relevant Microsoft Purview investigation experience and remediation workflow for the identified risky or compromised entity
Review the automatic attack disruption actions and incident evidence, then validate or complete the required remediation
Query Microsoft Graph activity logs to investigate the application or API activity associated with the suspected threat
Open and investigate the Microsoft Sentinel incident, review its entities and evidence, and perform the required remediation workflow

Correct answer: C

Option review:

A: Microsoft Entra ID risk detections and identity-protection controls are the primary source for investigating compromised identities and enforcing identity remediation. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: review and complete remediation after automatic attack disruption has contained part of an attack.

B: Purview surfaces data-governance and insider/compliance signals that can identify risky activity or entities requiring investigation and policy-driven remediation. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: review and complete remediation after automatic attack disruption has contained part of an attack.

C: Attack disruption may automatically contain affected assets during an active attack, but analysts still need to review the incident and complete or validate remediation. This directly addresses the requirement: review and complete remediation after automatic attack disruption has contained part of an attack.

D: Microsoft Graph activity logs provide request-level visibility into Graph API activity and are appropriate when the investigation centers on application or API access to Microsoft 365 data. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: review and complete remediation after automatic attack disruption has contained part of an attack.

E: Sentinel incidents aggregate alerts and related entities into a case for triage, investigation, assignment, status tracking, and response. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: review and complete remediation after automatic attack disruption has contained part of an attack.

Learning point: Review the automatic attack disruption actions and incident evidence, then validate or complete the required remediation

Question 15

A runbook for the regulated workload segment, response wave 8 contains this description: Evidence and entity investigation connects artifacts and identities to the incident so analysts can validate scope, relationships, and remediation targets. Which implementation belongs in that runbook during a detection-engineering sprint? The process should separate collection from detection logic.

Use Microsoft Defender for Office 365 investigation and remediation actions for the malicious message, campaign, or collaboration threat
Open and investigate the Microsoft Sentinel incident, review its entities and evidence, and perform the required remediation workflow
Pivot through Defender evidence and entity pages to validate the affected files, processes, users, devices, and related indicators
Use the incident case-management fields and workflow to assign ownership, document status, track evidence, and coordinate response
Correlate the incident across identities, endpoints, cloud resources, and other affected domains to reconstruct the attack sequence and lateral movement

Correct answer: C

Option review:

A: Defender for Office 365 provides message, campaign, and entity investigation with remediation actions and can participate in coordinated attack disruption for eligible attacks. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: trace the incident through related evidence and entities to determine scope and affected assets.

B: Sentinel incidents aggregate alerts and related entities into a case for triage, investigation, assignment, status tracking, and response. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: trace the incident through related evidence and entities to determine scope and affected assets.

E: Complex attacks span multiple stages or security domains, so the analyst must connect related evidence and entity activity rather than investigating each alert in isolation. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: trace the incident through related evidence and entities to determine scope and affected assets.

Learning point: Pivot through Defender evidence and entity pages to validate the affected files, processes, users, devices, and related indicators

Question 16

Fabrikam Retail is troubleshooting a audit investigation. Evidence shows that the decisive requirement is to review and complete remediation after automatic attack disruption has contained part of an attack. Which action should the Tier 2 analyst investigate first for the Tier 1 queue, response wave 8, without losing the ability to preserve investigation context?

Use Microsoft Purview eDiscovery Content search to locate the relevant messages, files, or other discoverable Microsoft 365 content
Review the Microsoft Defender for Endpoint device timeline for the affected endpoint and time window
Use the appropriate Defender for Endpoint device action, such as live response or collection of an investigation package
Review the automatic attack disruption actions and incident evidence, then validate or complete the required remediation
Query Microsoft Graph activity logs to investigate the application or API activity associated with the suspected threat

Correct answer: D

Option review:

A: Content search is designed to find content across supported Microsoft 365 locations using investigation criteria and is appropriate when the analyst needs the actual discoverable content. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: review and complete remediation after automatic attack disruption has contained part of an attack.

B: The device timeline provides chronological endpoint events and alerts so analysts can reconstruct process, file, network, registry, and user activity around the incident. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: review and complete remediation after automatic attack disruption has contained part of an attack.

C: Live response supports remote investigation and command execution on supported endpoints, while investigation packages collect endpoint artifacts for deeper analysis. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: review and complete remediation after automatic attack disruption has contained part of an attack.

E: Microsoft Graph activity logs provide request-level visibility into Graph API activity and are appropriate when the investigation centers on application or API access to Microsoft 365 data. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: review and complete remediation after automatic attack disruption has contained part of an attack.

Learning point: Review the automatic attack disruption actions and incident evidence, then validate or complete the required remediation

Question 17

After eliminating network and licensing causes, the Sentinel administrator at Tailspin Toys determines that success depends on the ability to trace the incident through related evidence and entities to determine scope and affected assets. Which security action should be checked next for the identity-response team, response wave 9? The team must preserve investigation context.

Pivot through Defender evidence and entity pages to validate the affected files, processes, users, devices, and related indicators
Use Microsoft Purview eDiscovery Content search to locate the relevant messages, files, or other discoverable Microsoft 365 content
Use Microsoft Defender for Cloud Apps to investigate the risky cloud-app activity and apply the appropriate session, user, file, or app remediation
Use Microsoft Defender for Cloud workload-protection alerts and recommendations to investigate and remediate the affected cloud resource
Correlate the incident across identities, endpoints, cloud resources, and other affected domains to reconstruct the attack sequence and lateral movement

Correct answer: A

Option review:

B: Content search is designed to find content across supported Microsoft 365 locations using investigation criteria and is appropriate when the analyst needs the actual discoverable content. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: trace the incident through related evidence and entities to determine scope and affected assets.

C: Defender for Cloud Apps provides cloud-app activity, risk, governance, and control context that is appropriate for investigating risky SaaS usage and entities. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: trace the incident through related evidence and entities to determine scope and affected assets.

Learning point: Pivot through Defender evidence and entity pages to validate the affected files, processes, users, devices, and related indicators

Question 18

A service-desk escalation during a lateral-movement investigation has been narrowed to one security-operations requirement: review and complete remediation after automatic attack disruption has contained part of an attack. Which configuration is the most relevant starting point for the endpoint-response team, response wave 9 if the SOC wants to minimize manual analyst steps?

Review the automatic attack disruption actions and incident evidence, then validate or complete the required remediation
Use Microsoft Purview eDiscovery Content search to locate the relevant messages, files, or other discoverable Microsoft 365 content
Search Microsoft Purview Audit for the relevant user, admin, file, or service activity during the investigation window
Open and investigate the Microsoft Sentinel incident, review its entities and evidence, and perform the required remediation workflow
Investigate the Microsoft Entra ID identity risk and remediate the compromised account using the appropriate identity-protection action

Correct answer: A

Option review:

C: Purview Audit provides searchable Microsoft 365 audit events that help analysts establish who performed an action, on which object, and when. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: review and complete remediation after automatic attack disruption has contained part of an attack.

D: Sentinel incidents aggregate alerts and related entities into a case for triage, investigation, assignment, status tracking, and response. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: review and complete remediation after automatic attack disruption has contained part of an attack.

Learning point: Review the automatic attack disruption actions and incident evidence, then validate or complete the required remediation

Question 19

The failure pattern at Trey Research affects the messaging-security team, response wave 10. Before making unrelated policy changes, the security operations analyst needs a solution that will trace the incident through related evidence and entities to determine scope and affected assets. Which action is most directly relevant and helps minimize manual analyst steps?

Use Microsoft Defender for Cloud workload-protection alerts and recommendations to investigate and remediate the affected cloud resource
Investigate the Microsoft Entra ID identity risk and remediate the compromised account using the appropriate identity-protection action
Use the relevant Microsoft Purview investigation experience and remediation workflow for the identified risky or compromised entity
Review the Microsoft Defender for Endpoint device timeline for the affected endpoint and time window
Pivot through Defender evidence and entity pages to validate the affected files, processes, users, devices, and related indicators

Correct answer: E

Option review:

A: Defender for Cloud workload protections surface resource-specific security alerts and context for cloud workloads so the SOC can investigate and remediate the affected resource. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: trace the incident through related evidence and entities to determine scope and affected assets.

B: Microsoft Entra ID risk detections and identity-protection controls are the primary source for investigating compromised identities and enforcing identity remediation. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: trace the incident through related evidence and entities to determine scope and affected assets.

D: The device timeline provides chronological endpoint events and alerts so analysts can reconstruct process, file, network, registry, and user activity around the incident. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: trace the incident through related evidence and entities to determine scope and affected assets.

Learning point: Pivot through Defender evidence and entity pages to validate the affected files, processes, users, devices, and related indicators

Question 20

While investigating a security automation project, Lucerne Publishing confirms the environment must review and complete remediation after automatic attack disruption has contained part of an attack. Which Microsoft security capability should be validated for the night shift, response wave 10? The investigation should retain evidence for follow-up analysis.

Use the incident case-management fields and workflow to assign ownership, document status, track evidence, and coordinate response
Use Microsoft Defender for Cloud Apps to investigate the risky cloud-app activity and apply the appropriate session, user, file, or app remediation
Use Microsoft Defender for Identity alert and entity context to investigate the suspicious identity activity and remediate the affected account or infrastructure
Use Microsoft Defender for Cloud workload-protection alerts and recommendations to investigate and remediate the affected cloud resource
Review the automatic attack disruption actions and incident evidence, then validate or complete the required remediation

Correct answer: E

Option review:

A: Case management provides the operational structure for ownership, status, comments, tasks, and collaboration throughout the incident lifecycle. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: review and complete remediation after automatic attack disruption has contained part of an attack.

B: Defender for Cloud Apps provides cloud-app activity, risk, governance, and control context that is appropriate for investigating risky SaaS usage and entities. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: review and complete remediation after automatic attack disruption has contained part of an attack.

C: Defender for Identity correlates identity and directory activity to detect suspicious behavior in identity infrastructure and provides entity context for investigation. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: review and complete remediation after automatic attack disruption has contained part of an attack.

D: Defender for Cloud workload protections surface resource-specific security alerts and context for cloud workloads so the SOC can investigate and remediate the affected resource. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: review and complete remediation after automatic attack disruption has contained part of an attack.

E: Attack disruption may automatically contain affected assets during an active attack, but analysts still need to review the incident and complete or validate remediation. This directly addresses the requirement: review and complete remediation after automatic attack disruption has contained part of an attack.

Learning point: Review the automatic attack disruption actions and incident evidence, then validate or complete the required remediation

Question 21

Two teams at Litware Manufacturing propose different approaches for the Americas SOC, response wave 11. The selection criterion is simple: the chosen approach must trace the incident through related evidence and entities to determine scope and affected assets. Which option should win the technical comparison if the SOC also wants to retain evidence for follow-up analysis?

Search Microsoft Purview Audit for the relevant user, admin, file, or service activity during the investigation window
Use Microsoft Purview eDiscovery Content search to locate the relevant messages, files, or other discoverable Microsoft 365 content
Correlate the incident across identities, endpoints, cloud resources, and other affected domains to reconstruct the attack sequence and lateral movement
Open and investigate the Microsoft Sentinel incident, review its entities and evidence, and perform the required remediation workflow
Pivot through Defender evidence and entity pages to validate the affected files, processes, users, devices, and related indicators

Correct answer: E

Option review:

A: Purview Audit provides searchable Microsoft 365 audit events that help analysts establish who performed an action, on which object, and when. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: trace the incident through related evidence and entities to determine scope and affected assets.

B: Content search is designed to find content across supported Microsoft 365 locations using investigation criteria and is appropriate when the analyst needs the actual discoverable content. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: trace the incident through related evidence and entities to determine scope and affected assets.

D: Sentinel incidents aggregate alerts and related entities into a case for triage, investigation, assignment, status tracking, and response. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: trace the incident through related evidence and entities to determine scope and affected assets.

Learning point: Pivot through Defender evidence and entity pages to validate the affected files, processes, users, devices, and related indicators

Question 22

For the high-value-assets group, response wave 11, Woodgrove Bank wants the least indirect solution to this goal: review and complete remediation after automatic attack disruption has contained part of an attack. Which action aligns most closely with that requirement and the need to avoid unnecessary alert noise?

Open and investigate the Microsoft Sentinel incident, review its entities and evidence, and perform the required remediation workflow
Correlate the incident across identities, endpoints, cloud resources, and other affected domains to reconstruct the attack sequence and lateral movement
Review the automatic attack disruption actions and incident evidence, then validate or complete the required remediation
Search Microsoft Purview Audit for the relevant user, admin, file, or service activity during the investigation window
Use Microsoft Purview eDiscovery Content search to locate the relevant messages, files, or other discoverable Microsoft 365 content

Correct answer: C

Option review:

A: Sentinel incidents aggregate alerts and related entities into a case for triage, investigation, assignment, status tracking, and response. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: review and complete remediation after automatic attack disruption has contained part of an attack.

B: Complex attacks span multiple stages or security domains, so the analyst must connect related evidence and entity activity rather than investigating each alert in isolation. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: review and complete remediation after automatic attack disruption has contained part of an attack.

D: Purview Audit provides searchable Microsoft 365 audit events that help analysts establish who performed an action, on which object, and when. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: review and complete remediation after automatic attack disruption has contained part of an attack.

E: Content search is designed to find content across supported Microsoft 365 locations using investigation criteria and is appropriate when the analyst needs the actual discoverable content. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: review and complete remediation after automatic attack disruption has contained part of an attack.

Learning point: Review the automatic attack disruption actions and incident evidence, then validate or complete the required remediation

Question 23

A modernization plan at Fourth Coffee includes a identity compromise review. The Defender administrator is asked to choose the control that specifically helps the organization trace the incident through related evidence and entities to determine scope and affected assets. Which choice fits best for the server fleet, response wave 12 while supporting the goal to avoid unnecessary alert noise?

Use Microsoft Defender for Identity alert and entity context to investigate the suspicious identity activity and remediate the affected account or infrastructure
Use Microsoft Defender for Cloud Apps to investigate the risky cloud-app activity and apply the appropriate session, user, file, or app remediation
Investigate the Microsoft Entra ID identity risk and remediate the compromised account using the appropriate identity-protection action
Pivot through Defender evidence and entity pages to validate the affected files, processes, users, devices, and related indicators
Search Microsoft Purview Audit for the relevant user, admin, file, or service activity during the investigation window

Correct answer: D

Option review:

A: Defender for Identity correlates identity and directory activity to detect suspicious behavior in identity infrastructure and provides entity context for investigation. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: trace the incident through related evidence and entities to determine scope and affected assets.

B: Defender for Cloud Apps provides cloud-app activity, risk, governance, and control context that is appropriate for investigating risky SaaS usage and entities. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: trace the incident through related evidence and entities to determine scope and affected assets.

C: Microsoft Entra ID risk detections and identity-protection controls are the primary source for investigating compromised identities and enforcing identity remediation. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: trace the incident through related evidence and entities to determine scope and affected assets.

D: Evidence and entity investigation connects artifacts and identities to the incident so analysts can validate scope, relationships, and remediation targets. This directly addresses the requirement: trace the incident through related evidence and entities to determine scope and affected assets.

E: Purview Audit provides searchable Microsoft 365 audit events that help analysts establish who performed an action, on which object, and when. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: trace the incident through related evidence and entities to determine scope and affected assets.

Learning point: Pivot through Defender evidence and entity pages to validate the affected files, processes, users, devices, and related indicators

Question 24

The remote-user fleet, response wave 12 is moving into a controlled rollout at A. Datum. Which action should be included when the stated security objective is to review and complete remediation after automatic attack disruption has contained part of an attack? The operational standard is to preserve least privilege.

Correlate the incident across identities, endpoints, cloud resources, and other affected domains to reconstruct the attack sequence and lateral movement
Query Microsoft Graph activity logs to investigate the application or API activity associated with the suspected threat
Review the automatic attack disruption actions and incident evidence, then validate or complete the required remediation
Use Microsoft Defender for Office 365 investigation and remediation actions for the malicious message, campaign, or collaboration threat
Use the appropriate Defender for Endpoint device action, such as live response or collection of an investigation package

Correct answer: C

Option review:

A: Complex attacks span multiple stages or security domains, so the analyst must connect related evidence and entity activity rather than investigating each alert in isolation. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: review and complete remediation after automatic attack disruption has contained part of an attack.

B: Microsoft Graph activity logs provide request-level visibility into Graph API activity and are appropriate when the investigation centers on application or API access to Microsoft 365 data. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: review and complete remediation after automatic attack disruption has contained part of an attack.

D: Defender for Office 365 provides message, campaign, and entity investigation with remediation actions and can participate in coordinated attack disruption for eligible attacks. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: review and complete remediation after automatic attack disruption has contained part of an attack.

E: Live response supports remote investigation and command execution on supported endpoints, while investigation packages collect endpoint artifacts for deeper analysis. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: review and complete remediation after automatic attack disruption has contained part of an attack.

Learning point: Review the automatic attack disruption actions and incident evidence, then validate or complete the required remediation

Question 25

Fabrikam Retail is replacing an ad hoc process during a ransomware response. The replacement must reliably trace the incident through related evidence and entities to determine scope and affected assets. Which security-operations approach should the SOC analyst implement for the research subscription, response wave 13 if the team also wants to preserve least privilege?

Use the appropriate Defender for Endpoint device action, such as live response or collection of an investigation package
Use the embedded Microsoft Security Copilot or agentic investigation capability to summarize, analyze, and accelerate the incident investigation
Use Microsoft Purview eDiscovery Content search to locate the relevant messages, files, or other discoverable Microsoft 365 content
Pivot through Defender evidence and entity pages to validate the affected files, processes, users, devices, and related indicators
Review the Microsoft Defender for Endpoint device timeline for the affected endpoint and time window

Correct answer: D

Option review:

A: Live response supports remote investigation and command execution on supported endpoints, while investigation packages collect endpoint artifacts for deeper analysis. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: trace the incident through related evidence and entities to determine scope and affected assets.

B: Security Copilot can synthesize incident context, explain security data, and assist analysts while the analyst remains responsible for validating evidence and response decisions. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: trace the incident through related evidence and entities to determine scope and affected assets.

C: Content search is designed to find content across supported Microsoft 365 locations using investigation criteria and is appropriate when the analyst needs the actual discoverable content. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: trace the incident through related evidence and entities to determine scope and affected assets.

E: The device timeline provides chronological endpoint events and alerts so analysts can reconstruct process, file, network, registry, and user activity around the incident. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: trace the incident through related evidence and entities to determine scope and affected assets.

Learning point: Pivot through Defender evidence and entity pages to validate the affected files, processes, users, devices, and related indicators

Question 26

An audit finding for the regulated workload segment, response wave 13 says the current process does not consistently review and complete remediation after automatic attack disruption has contained part of an attack. Which Microsoft security action most directly closes that gap while helping the SOC reduce mean time to respond?

Use the appropriate Defender for Endpoint device action, such as live response or collection of an investigation package
Review the automatic attack disruption actions and incident evidence, then validate or complete the required remediation
Use the incident case-management fields and workflow to assign ownership, document status, track evidence, and coordinate response
Use Microsoft Defender for Identity alert and entity context to investigate the suspicious identity activity and remediate the affected account or infrastructure
Open and investigate the Microsoft Sentinel incident, review its entities and evidence, and perform the required remediation workflow

Correct answer: B

Option review:

A: Live response supports remote investigation and command execution on supported endpoints, while investigation packages collect endpoint artifacts for deeper analysis. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: review and complete remediation after automatic attack disruption has contained part of an attack.

B: Attack disruption may automatically contain affected assets during an active attack, but analysts still need to review the incident and complete or validate remediation. This directly addresses the requirement: review and complete remediation after automatic attack disruption has contained part of an attack.

Learning point: Review the automatic attack disruption actions and incident evidence, then validate or complete the required remediation

Question 27

The threat hunter at Alpine Ski House needs a repeatable configuration for the Tier 2 queue, response wave 14. It must trace the incident through related evidence and entities to determine scope and affected assets. Which choice should be implemented instead of relying on manual incident work if the goal is to reduce mean time to respond?

Correlate the incident across identities, endpoints, cloud resources, and other affected domains to reconstruct the attack sequence and lateral movement
Use Microsoft Purview eDiscovery Content search to locate the relevant messages, files, or other discoverable Microsoft 365 content
Use the relevant Microsoft Purview investigation experience and remediation workflow for the identified risky or compromised entity
Pivot through Defender evidence and entity pages to validate the affected files, processes, users, devices, and related indicators
Review the Microsoft Defender for Endpoint device timeline for the affected endpoint and time window

Correct answer: D

Option review:

A: Complex attacks span multiple stages or security domains, so the analyst must connect related evidence and entity activity rather than investigating each alert in isolation. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: trace the incident through related evidence and entities to determine scope and affected assets.

B: Content search is designed to find content across supported Microsoft 365 locations using investigation criteria and is appropriate when the analyst needs the actual discoverable content. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: trace the incident through related evidence and entities to determine scope and affected assets.

Learning point: Pivot through Defender evidence and entity pages to validate the affected files, processes, users, devices, and related indicators

Question 28

During readiness testing at Wide World Importers, the identity-response team, response wave 14 fails a business requirement because analysts cannot yet review and complete remediation after automatic attack disruption has contained part of an attack. Which action should be implemented before rollout continues? The SOC also needs to scope the change to the affected security domain.

Use the relevant Microsoft Purview investigation experience and remediation workflow for the identified risky or compromised entity
Use Microsoft Defender for Cloud Apps to investigate the risky cloud-app activity and apply the appropriate session, user, file, or app remediation
Use the embedded Microsoft Security Copilot or agentic investigation capability to summarize, analyze, and accelerate the incident investigation
Review the automatic attack disruption actions and incident evidence, then validate or complete the required remediation
Use the appropriate Defender for Endpoint device action, such as live response or collection of an investigation package

Correct answer: D

Option review:

A: Purview surfaces data-governance and insider/compliance signals that can identify risky activity or entities requiring investigation and policy-driven remediation. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: review and complete remediation after automatic attack disruption has contained part of an attack.

C: Security Copilot can synthesize incident context, explain security data, and assist analysts while the analyst remains responsible for validating evidence and response decisions. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: review and complete remediation after automatic attack disruption has contained part of an attack.

Learning point: Review the automatic attack disruption actions and incident evidence, then validate or complete the required remediation

Question 29

A governance review asks the Tier 2 analyst to justify the control selected for the cloud-security team, response wave 15. The requirement is to trace the incident through related evidence and entities to determine scope and affected assets. Which action has the clearest technical alignment while supporting the goal to scope the change to the affected security domain?

Review the automatic attack disruption actions and incident evidence, then validate or complete the required remediation
Pivot through Defender evidence and entity pages to validate the affected files, processes, users, devices, and related indicators
Use Microsoft Defender for Identity alert and entity context to investigate the suspicious identity activity and remediate the affected account or infrastructure
Open and investigate the Microsoft Sentinel incident, review its entities and evidence, and perform the required remediation workflow
Investigate the Microsoft Entra ID identity risk and remediate the compromised account using the appropriate identity-protection action

Correct answer: B

Option review:

A: Attack disruption may automatically contain affected assets during an active attack, but analysts still need to review the incident and complete or validate remediation. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: trace the incident through related evidence and entities to determine scope and affected assets.

C: Defender for Identity correlates identity and directory activity to detect suspicious behavior in identity infrastructure and provides entity context for investigation. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: trace the incident through related evidence and entities to determine scope and affected assets.

D: Sentinel incidents aggregate alerts and related entities into a case for triage, investigation, assignment, status tracking, and response. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: trace the incident through related evidence and entities to determine scope and affected assets.

E: Microsoft Entra ID risk detections and identity-protection controls are the primary source for investigating compromised identities and enforcing identity remediation. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: trace the incident through related evidence and entities to determine scope and affected assets.

Learning point: Pivot through Defender evidence and entity pages to validate the affected files, processes, users, devices, and related indicators

Question 30

For a detection-engineering sprint, Northwind Traders needs a Microsoft security capability with this effect: Attack disruption may automatically contain affected assets during an active attack, but analysts still need to review the incident and complete or validate remediation. Which option most accurately provides that capability for the messaging-security team, response wave 15? The process should keep the workflow auditable.

Use Microsoft Defender for Identity alert and entity context to investigate the suspicious identity activity and remediate the affected account or infrastructure
Review the Microsoft Defender for Endpoint device timeline for the affected endpoint and time window
Review the automatic attack disruption actions and incident evidence, then validate or complete the required remediation
Use the relevant Microsoft Purview investigation experience and remediation workflow for the identified risky or compromised entity
Use the appropriate Defender for Endpoint device action, such as live response or collection of an investigation package

Correct answer: C

Option review:

B: The device timeline provides chronological endpoint events and alerts so analysts can reconstruct process, file, network, registry, and user activity around the incident. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: review and complete remediation after automatic attack disruption has contained part of an attack.

D: Purview surfaces data-governance and insider/compliance signals that can identify risky activity or entities requiring investigation and policy-driven remediation. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: review and complete remediation after automatic attack disruption has contained part of an attack.

Learning point: Review the automatic attack disruption actions and incident evidence, then validate or complete the required remediation

Question 31

The operational standard for the EMEA SOC, response wave 16 is being rewritten. Which action should be documented when the standard requires analysts to trace the incident through related evidence and entities to determine scope and affected assets and the SOC wants to keep the workflow auditable?

Pivot through Defender evidence and entity pages to validate the affected files, processes, users, devices, and related indicators
Use Microsoft Defender for Identity alert and entity context to investigate the suspicious identity activity and remediate the affected account or infrastructure
Investigate the Microsoft Entra ID identity risk and remediate the compromised account using the appropriate identity-protection action
Review the Microsoft Defender for Endpoint device timeline for the affected endpoint and time window
Review the automatic attack disruption actions and incident evidence, then validate or complete the required remediation

Correct answer: A

Option review:

B: Defender for Identity correlates identity and directory activity to detect suspicious behavior in identity infrastructure and provides entity context for investigation. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: trace the incident through related evidence and entities to determine scope and affected assets.

C: Microsoft Entra ID risk detections and identity-protection controls are the primary source for investigating compromised identities and enforcing identity remediation. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: trace the incident through related evidence and entities to determine scope and affected assets.

D: The device timeline provides chronological endpoint events and alerts so analysts can reconstruct process, file, network, registry, and user activity around the incident. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: trace the incident through related evidence and entities to determine scope and affected assets.

E: Attack disruption may automatically contain affected assets during an active attack, but analysts still need to review the incident and complete or validate remediation. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: trace the incident through related evidence and entities to determine scope and affected assets.

Learning point: Pivot through Defender evidence and entity pages to validate the affected files, processes, users, devices, and related indicators

Question 32

Blue Yonder Airlines is creating a response playbook for the Americas SOC, response wave 16. Which Microsoft security step belongs in the playbook when the objective is to review and complete remediation after automatic attack disruption has contained part of an attack? The playbook should also help avoid changing an unrelated control plane.

Review the automatic attack disruption actions and incident evidence, then validate or complete the required remediation
Use the embedded Microsoft Security Copilot or agentic investigation capability to summarize, analyze, and accelerate the incident investigation
Open and investigate the Microsoft Sentinel incident, review its entities and evidence, and perform the required remediation workflow
Pivot through Defender evidence and entity pages to validate the affected files, processes, users, devices, and related indicators
Review the Microsoft Defender for Endpoint device timeline for the affected endpoint and time window

Correct answer: A

Option review:

B: Security Copilot can synthesize incident context, explain security data, and assist analysts while the analyst remains responsible for validating evidence and response decisions. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: review and complete remediation after automatic attack disruption has contained part of an attack.

D: Evidence and entity investigation connects artifacts and identities to the incident so analysts can validate scope, relationships, and remediation targets. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: review and complete remediation after automatic attack disruption has contained part of an attack.

E: The device timeline provides chronological endpoint events and alerts so analysts can reconstruct process, file, network, registry, and user activity around the incident. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: review and complete remediation after automatic attack disruption has contained part of an attack.

Learning point: Review the automatic attack disruption actions and incident evidence, then validate or complete the required remediation

Question 33

During a audit investigation at A. Datum, the Sentinel administrator must trace the incident through related evidence and entities to determine scope and affected assets. Which action most directly satisfies the requirement for the privileged-users group, response wave 17? The design priority is to avoid changing an unrelated control plane.

Search Microsoft Purview Audit for the relevant user, admin, file, or service activity during the investigation window
Use the appropriate Defender for Endpoint device action, such as live response or collection of an investigation package
Use Microsoft Defender for Cloud Apps to investigate the risky cloud-app activity and apply the appropriate session, user, file, or app remediation
Use the relevant Microsoft Purview investigation experience and remediation workflow for the identified risky or compromised entity
Pivot through Defender evidence and entity pages to validate the affected files, processes, users, devices, and related indicators

Correct answer: E

Option review:

B: Live response supports remote investigation and command execution on supported endpoints, while investigation packages collect endpoint artifacts for deeper analysis. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: trace the incident through related evidence and entities to determine scope and affected assets.

Learning point: Pivot through Defender evidence and entity pages to validate the affected files, processes, users, devices, and related indicators

Question 34

During containment validation at Wide World Importers, automatic attack disruption has already isolated part of a lateral-movement chain. The incident responder must determine which disruptive actions occurred, verify the remaining evidence, and finish remediation on the affected endpoints. Which action most directly addresses this post-disruption requirement for the privileged-server cohort?

Use Microsoft Defender for Cloud workload-protection alerts and recommendations to investigate and remediate the affected cloud resource
Investigate the Microsoft Entra ID identity risk and remediate the compromised account using the appropriate identity-protection action
Review the Microsoft Defender for Endpoint device timeline for the affected endpoint and time window
Review the automatic attack disruption actions and incident evidence, then validate or complete the required remediation
Use the appropriate Defender for Endpoint device action, such as live response or collection of an investigation package

Correct answer: D

Option review:

A: Defender for Cloud workload protections surface resource-specific security alerts and context for cloud workloads so the SOC can investigate and remediate the affected resource. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: review and complete remediation after automatic attack disruption has contained part of an attack.

B: Microsoft Entra ID risk detections and identity-protection controls are the primary source for investigating compromised identities and enforcing identity remediation. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: review and complete remediation after automatic attack disruption has contained part of an attack.

C: The device timeline provides chronological endpoint events and alerts so analysts can reconstruct process, file, network, registry, and user activity around the incident. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: review and complete remediation after automatic attack disruption has contained part of an attack.

Learning point: Review the automatic attack disruption actions and incident evidence, then validate or complete the required remediation

Question 35

A ticket escalated to the security operations analyst at Adventure Works states one non-negotiable goal: trace the incident through related evidence and entities to determine scope and affected assets. Which choice is the strongest fit for the production subscription, response wave 18? The team also wants to improve detection coverage.

Pivot through Defender evidence and entity pages to validate the affected files, processes, users, devices, and related indicators
Investigate the Microsoft Entra ID identity risk and remediate the compromised account using the appropriate identity-protection action
Use Microsoft Defender for Identity alert and entity context to investigate the suspicious identity activity and remediate the affected account or infrastructure
Use Microsoft Purview eDiscovery Content search to locate the relevant messages, files, or other discoverable Microsoft 365 content
Review the Microsoft Defender for Endpoint device timeline for the affected endpoint and time window

Correct answer: A

Option review:

C: Defender for Identity correlates identity and directory activity to detect suspicious behavior in identity infrastructure and provides entity context for investigation. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: trace the incident through related evidence and entities to determine scope and affected assets.

Learning point: Pivot through Defender evidence and entity pages to validate the affected files, processes, users, devices, and related indicators

Question 1

Question 2

Question 3

Question 4

Question 5

Question 6

Question 7

Question 8

Question 9

Question 10

Question 11

Question 12

Question 13

Question 14

Question 15

Question 16

Question 17

Question 18

Question 19

Question 20

Question 21

Question 22

Question 23

Question 24

Question 25

Question 26

Question 27

Question 28

Question 29

Question 30

Question 31

Question 32

Question 33

Question 34

Question 35

Related posts: