Microsoft SC-300 Identity Logs KQL Reporting and Security Posture Practice Test

 

Topic 16 covers identity logs, kql, reporting, and security posture for the Microsoft Certified: Identity and Access Administrator Associate certification. These original practice questions apply the verified SC-300 objectives to practical decisions and troubleshooting. Select one answer unless a fixed number is requested. For broader preparation, visit the SC-300 Exam Dumps page. Each option includes an explanation of the relevant behavior and scenario constraints.

Question 1

Operations staff investigating an authentication failure being investigated have isolated the issue to: the correct sign-in-log evidence for the authentication failure. The tenant has the licensing required for the named capability. Which action best satisfies the requirement?

1. Use Microsoft Entra workbooks when the requirement is a reusable visualization built from identity telemetry.
2. Use the Conditional Access details in Microsoft Entra sign-in logs to identify which policy and control produced the sign-in result.
3. Send logs to Azure Event Hubs when a streaming integration or external SIEM pipeline requires event delivery.
4. Use Microsoft Entra sign-in logs for authentication, Conditional Access, client, and sign-in-result evidence.
5. Join the relevant identity events in KQL using validated identifiers and compatible time windows.

Correct Answer: D

 

Correct Answer

Answer D is correct because This action directly provides the appropriate sign-in log for authentication failure evidence. It changes the control that owns the stated requirement while preserving unrelated access and can be verified with Microsoft Entra evidence.

Incorrect Answers

Answer A is incorrect because This action is appropriate when the requirement is the appropriate workbook for relevant identity monitoring scenario. The scenario instead requires the appropriate sign-in log for authentication failure evidence, so this option would solve an adjacent identity problem rather than the documented gap.

Answer B is incorrect because This action is appropriate when the requirement is diagnosis of conditional-access result within sign-in details. The scenario instead requires the appropriate sign-in log for authentication failure evidence, so this option would solve an adjacent identity problem rather than the documented gap.

Answer C is incorrect because This action is appropriate when the requirement is the appropriate Event Hubs destination for external event consumer. The scenario instead requires the appropriate sign-in log for authentication failure evidence, so this option would solve an adjacent identity problem rather than the documented gap.

Answer E is incorrect because This action is appropriate when the requirement is joining of relevant events using validated identifiers. The scenario instead requires the appropriate sign-in log for authentication failure evidence, so this option would solve an adjacent identity problem rather than the documented gap.

 

Question 2

The administrator must correct an unexpected directory configuration change without changing adjacent controls. The target condition is: the appropriate audit log for directory configuration change. The correction must address the named control boundary rather than reset unrelated tenant settings. Which action best satisfies the requirement?

1. Use Microsoft Entra workbooks when the requirement is a reusable visualization built from identity telemetry.
2. Use provisioning logs to confirm whether provisioning succeeded, then check the target application separately for resource authorization.
3. Parse and handle the dynamic Conditional Access fields explicitly in the KQL query before filtering or aggregating them.
4. Enable required log categories without assuming defaults for only the intended scope in Microsoft Entra monitoring.
5. Use Microsoft Entra audit logs for directory configuration and object-change evidence.

Correct Answer: E

 

Correct Answer

Answer E is correct because This action directly provides the appropriate audit log for directory configuration change. It changes the control that owns the stated requirement while preserving unrelated access and can be verified with Microsoft Entra evidence.

Incorrect Answers

Answer A is incorrect because This action is appropriate when the requirement is the required setting for workbook time range and required data source. The scenario instead requires the appropriate audit log for directory configuration change, so this option would solve an adjacent identity problem rather than the documented gap.

Answer B is incorrect because This action is appropriate when the requirement is correct interpretation of provisioning status versus target-system access. The scenario instead requires the appropriate audit log for directory configuration change, so this option would solve an adjacent identity problem rather than the documented gap.

Answer C is incorrect because This action is appropriate when the requirement is handling of dynamic conditional-access fields safely. The scenario instead requires the appropriate audit log for directory configuration change, so this option would solve an adjacent identity problem rather than the documented gap.

Answer D is incorrect because This action is appropriate when the requirement is enablement of required log categories without assuming defaults. The scenario instead requires the appropriate audit log for directory configuration change, so this option would solve an adjacent identity problem rather than the documented gap.

 

Question 3

An audit of an enterprise-app provisioning failure identifies this control gap: the appropriate provisioning log for synchronization failure. No new standing administrator privilege may be introduced. Which action best satisfies the requirement?

1. Use sign-in, audit, provisioning, diagnostic, KQL, workbook, and reporting evidence to diagnose missing export from diagnostic setting or destination.
2. Use Microsoft Entra provisioning logs for application or cross-tenant provisioning operations and failures.
3. Treat a workbook trend as observational evidence and corroborate it before attributing a cause.
4. Use the event timestamp for the investigation window and treat ingestion time as a separate pipeline characteristic.
5. Assign the least-privilege Microsoft Entra monitoring/log-reader role that permits the required investigation without broader directory administration.

Correct Answer: B

 

Correct Answer

Answer B is correct because This action directly provides the appropriate provisioning log for synchronization failure. It changes the control that owns the stated requirement while preserving unrelated access and can be verified with Microsoft Entra evidence.

Incorrect Answers

Answer A is incorrect because This action is appropriate when the requirement is diagnosis of missing export from diagnostic setting or destination. The scenario instead requires the appropriate provisioning log for synchronization failure, so this option would solve an adjacent identity problem rather than the documented gap.

Answer C is incorrect because This action is appropriate when the requirement is correct interpretation of trend without assuming causality. The scenario instead requires the appropriate provisioning log for synchronization failure, so this option would solve an adjacent identity problem rather than the documented gap.

Answer D is incorrect because This action is appropriate when the requirement is a clear distinction between event time and ingestion delay. The scenario instead requires the appropriate provisioning log for synchronization failure, so this option would solve an adjacent identity problem rather than the documented gap.

Answer E is incorrect because This action is appropriate when the requirement is application of least-privilege log-reader role for investigation. The scenario instead requires the appropriate provisioning log for synchronization failure, so this option would solve an adjacent identity problem rather than the documented gap.

 

Question 4

The documented success criterion for an authentication failure being investigated is: a clear distinction between interactive and noninteractive sign-in records. General network connectivity outside the identity path is already verified. Which action best satisfies the requirement?

1. Send logs to a Log Analytics workspace when KQL querying, correlation, and retained analytics are required.
2. Handle null or missing fields explicitly in KQL and avoid treating absence as proof of a successful or failed control.
3. Use KQL or the sign-in log filters to limit records to the stated time window and sign-in result.
4. Use Microsoft Entra workbooks when the requirement is a reusable visualization built from identity telemetry.
5. Use the sign-in log record type and client context to distinguish interactive from noninteractive authentication activity.

Correct Answer: E

 

Correct Answer

Answer E is correct because This action directly provides a clear distinction between interactive and noninteractive sign-in records. It changes the control that owns the stated requirement while preserving unrelated access and can be verified with Microsoft Entra evidence.

Incorrect Answers

Answer A is incorrect because This action is appropriate when the requirement is the appropriate Log Analytics destination for query requirement. The scenario instead requires a clear distinction between interactive and noninteractive sign-in records, so this option would solve an adjacent identity problem rather than the documented gap.

Answer B is incorrect because This action is appropriate when the requirement is correct interpretation of null or missing fields without false conclusions. The scenario instead requires a clear distinction between interactive and noninteractive sign-in records, so this option would solve an adjacent identity problem rather than the documented gap.

Answer C is incorrect because This action is appropriate when the requirement is filtering of sign-ins by time window and result. The scenario instead requires a clear distinction between interactive and noninteractive sign-in records, so this option would solve an adjacent identity problem rather than the documented gap.

Answer D is incorrect because This action is appropriate when the requirement is diagnosis of workbook permissions versus missing telemetry. The scenario instead requires a clear distinction between interactive and noninteractive sign-in records, so this option would solve an adjacent identity problem rather than the documented gap.

 

Question 5

The current configuration of an identity monitoring investigation is otherwise acceptable. The unresolved requirement is: correlate user and application identifiers across events. Resource permissions outside the identity control are already correct. Which action best satisfies the requirement?

1. Send the required Microsoft Entra diagnostic logs to an Azure Storage account when long-term archival retention is the primary requirement.
2. Use Identity Secure Score recommendations to identify posture improvements, then validate each recommendation against the tenant’s requirements.
3. Compare the KQL result to the explicitly defined investigation population and denominator before drawing conclusions.
4. Use KQL in Log Analytics to summarize failed Microsoft Entra sign-ins by user and application over the defined time window.
5. Correlate the relevant identity events in KQL using stable user/application or correlation identifiers and aligned event-time windows before drawing a conclusion.

Correct Answer: E

 

Correct Answer

Answer E is correct because This action directly resolves correlate user and application identifiers across events at the evidence or control boundary described by the scenario, rather than substituting a neighboring identity workflow.

Incorrect Answers

Answer A is incorrect because This action is appropriate when the requirement is the appropriate storage destination for stated archive need. The scenario instead requires correlate user and application identifiers across events, so this option would solve an adjacent identity problem rather than the documented gap.

Answer B is incorrect because This action is appropriate when the requirement is prioritization of Identity Secure Score recommendation by exposure. The scenario instead requires correlate user and application identifiers across events, so this option would solve an adjacent identity problem rather than the documented gap.

Answer C is incorrect because This action is appropriate when the requirement is comparison of query result with defined investigation population. The scenario instead requires correlate user and application identifiers across events, so this option would solve an adjacent identity problem rather than the documented gap.

Answer D is incorrect because This action is appropriate when the requirement is a summary of failed sign-ins by user and application. The scenario instead requires correlate user and application identifiers across events, so this option would solve an adjacent identity problem rather than the documented gap.

 

Question 6

A troubleshooting review of an authentication failure being investigated confirms that the next action must address: diagnosis of conditional-access result within sign-in details. The administrator must verify the effective result from Microsoft Entra evidence. Choose TWO actions that together implement and verify the requirement.

1. Use sign-in, audit, provisioning, diagnostic, KQL, workbook, and reporting evidence to distinguish score improvement from proof of protection.
2. Join the relevant identity events in KQL using validated identifiers and compatible time windows.
3. Use the Conditional Access details in Microsoft Entra sign-in logs to identify which policy and control produced the sign-in result.
4. Use Microsoft Entra workbooks when the requirement is a reusable visualization built from identity telemetry.
5. Query the selected log destination and verify the expected records, fields, and time range before relying on the report.
6. Send logs to Azure Event Hubs when a streaming integration or external SIEM pipeline requires event delivery.

Correct Answers: C, E

 

Correct Answers

Answer C is correct because This action directly provides diagnosis of conditional-access result within sign-in details at the correct Microsoft Entra control boundary.

Answer E is correct because This verification step confirms that the selected control changes effective behavior for the intended pilot and exposes policy, assignment, propagation, or evidence problems before wider rollout.

Incorrect Answers

Answer A is incorrect because This action is appropriate when the requirement is a clear distinction between score improvement and proof of protection. It does not implement or verify diagnosis of conditional-access result within sign-in details in this scenario.

Answer B is incorrect because This action is appropriate when the requirement is joining of relevant events using validated identifiers. It does not implement or verify diagnosis of conditional-access result within sign-in details in this scenario.

Answer D is incorrect because This action is appropriate when the requirement is the appropriate workbook for relevant identity monitoring scenario. It does not implement or verify diagnosis of conditional-access result within sign-in details in this scenario.

Answer F is incorrect because This action is appropriate when the requirement is the appropriate Event Hubs destination for external event consumer. It does not implement or verify diagnosis of conditional-access result within sign-in details in this scenario.

 

Question 7

A staged rollout of an enterprise-app provisioning failure cannot proceed until the team can demonstrate: correct interpretation of provisioning status versus target-system access. The organization requires a supported Microsoft-managed control. Which action best satisfies the requirement?

1. Enable required log categories without assuming defaults for only the intended scope in Microsoft Entra monitoring.
2. Use provisioning logs to confirm whether provisioning succeeded, then check the target application separately for resource authorization.
3. Parse and handle the dynamic Conditional Access fields explicitly in the KQL query before filtering or aggregating them.
4. Recheck the Identity Secure Score recommendation after the configuration change and allow for evaluation/refresh timing before closing it.
5. Use Microsoft Entra workbooks when the requirement is a reusable visualization built from identity telemetry.

Correct Answer: B

 

Correct Answer

Answer B is correct because This action directly provides correct interpretation of provisioning status versus target-system access. It changes the control that owns the stated requirement while preserving unrelated access and can be verified with Microsoft Entra evidence.

Incorrect Answers

Answer A is incorrect because This action is appropriate when the requirement is enablement of required log categories without assuming defaults. The scenario instead requires correct interpretation of provisioning status versus target-system access, so this option would solve an adjacent identity problem rather than the documented gap.

Answer C is incorrect because This action is appropriate when the requirement is handling of dynamic conditional-access fields safely. The scenario instead requires correct interpretation of provisioning status versus target-system access, so this option would solve an adjacent identity problem rather than the documented gap.

Answer D is incorrect because This action is appropriate when the requirement is validation of recommendation status after configuration change. The scenario instead requires correct interpretation of provisioning status versus target-system access, so this option would solve an adjacent identity problem rather than the documented gap.

Answer E is incorrect because This action is appropriate when the requirement is the required setting for workbook time range and required data source. The scenario instead requires correct interpretation of provisioning status versus target-system access, so this option would solve an adjacent identity problem rather than the documented gap.

 

Question 8

The team compares supported controls for an identity monitoring investigation. The deciding condition is: application of least-privilege log-reader role for investigation. The current population and assignment scope must be preserved. Which action best satisfies the requirement?

1. Use sign-in, audit, provisioning, diagnostic, KQL, workbook, and reporting evidence to diagnose missing export from diagnostic setting or destination.
2. Assign the least-privilege Microsoft Entra monitoring/log-reader role that permits the required investigation without broader directory administration.
3. Use the event timestamp for the investigation window and treat ingestion time as a separate pipeline characteristic.
4. Use Identity Secure Score as posture guidance, not proof that all residual identity risk has been eliminated.
5. Treat a workbook trend as observational evidence and corroborate it before attributing a cause.

Correct Answer: B

 

Correct Answer

Answer B is correct because This action directly provides application of least-privilege log-reader role for investigation. It changes the control that owns the stated requirement while preserving unrelated access and can be verified with Microsoft Entra evidence.

Incorrect Answers

Answer A is incorrect because This action is appropriate when the requirement is diagnosis of missing export from diagnostic setting or destination. The scenario instead requires application of least-privilege log-reader role for investigation, so this option would solve an adjacent identity problem rather than the documented gap.

Answer C is incorrect because This action is appropriate when the requirement is a clear distinction between event time and ingestion delay. The scenario instead requires application of least-privilege log-reader role for investigation, so this option would solve an adjacent identity problem rather than the documented gap.

Answer D is incorrect because This action is appropriate when the requirement is an explanation of remaining risk despite higher posture score. The scenario instead requires application of least-privilege log-reader role for investigation, so this option would solve an adjacent identity problem rather than the documented gap.

Answer E is incorrect because This action is appropriate when the requirement is correct interpretation of trend without assuming causality. The scenario instead requires application of least-privilege log-reader role for investigation, so this option would solve an adjacent identity problem rather than the documented gap.

 

Question 9

The identity architect is reviewing an identity monitoring investigation. The required outcome is: the appropriate Log Analytics destination for query requirement. Existing working access outside the stated scope must remain unchanged. Which action best satisfies the requirement?

1. Use Microsoft Entra sign-in logs for authentication, Conditional Access, client, and sign-in-result evidence.
2. Handle null or missing fields explicitly in KQL and avoid treating absence as proof of a successful or failed control.
3. Use KQL or the sign-in log filters to limit records to the stated time window and sign-in result.
4. Use Microsoft Entra workbooks when the requirement is a reusable visualization built from identity telemetry.
5. Send logs to a Log Analytics workspace when KQL querying, correlation, and retained analytics are required.

Correct Answer: E

 

Correct Answer

Answer E is correct because This action directly provides the appropriate Log Analytics destination for query requirement. It changes the control that owns the stated requirement while preserving unrelated access and can be verified with Microsoft Entra evidence.

Incorrect Answers

Answer A is incorrect because This action is appropriate when the requirement is the appropriate sign-in log for authentication failure evidence. The scenario instead requires the appropriate Log Analytics destination for query requirement, so this option would solve an adjacent identity problem rather than the documented gap.

Answer B is incorrect because This action is appropriate when the requirement is correct interpretation of null or missing fields without false conclusions. The scenario instead requires the appropriate Log Analytics destination for query requirement, so this option would solve an adjacent identity problem rather than the documented gap.

Answer C is incorrect because This action is appropriate when the requirement is filtering of sign-ins by time window and result. The scenario instead requires the appropriate Log Analytics destination for query requirement, so this option would solve an adjacent identity problem rather than the documented gap.

Answer D is incorrect because This action is appropriate when the requirement is diagnosis of workbook permissions versus missing telemetry. The scenario instead requires the appropriate Log Analytics destination for query requirement, so this option would solve an adjacent identity problem rather than the documented gap.

 

Question 10

The change owner has limited the remediation for a compliance archive for long-term raw logs to this outcome: the appropriate storage destination for stated archive need. The change will be piloted before broader enforcement. Which action best satisfies the requirement?

1. Use KQL in Log Analytics to summarize failed Microsoft Entra sign-ins by user and application over the defined time window.
2. Compare the KQL result to the explicitly defined investigation population and denominator before drawing conclusions.
3. Send the required Microsoft Entra diagnostic logs to an Azure Storage account when long-term archival retention is the primary requirement.
4. Use Microsoft Entra audit logs for directory configuration and object-change evidence.
5. Use Identity Secure Score recommendations to identify posture improvements, then validate each recommendation against the tenant’s requirements.

Correct Answer: C

 

Correct Answer

Answer C is correct because This action directly provides the appropriate storage destination for stated archive need. It changes the control that owns the stated requirement while preserving unrelated access and can be verified with Microsoft Entra evidence.

Incorrect Answers

Answer A is incorrect because This action is appropriate when the requirement is a summary of failed sign-ins by user and application. The scenario instead requires the appropriate storage destination for stated archive need, so this option would solve an adjacent identity problem rather than the documented gap.

Answer B is incorrect because This action is appropriate when the requirement is comparison of query result with defined investigation population. The scenario instead requires the appropriate storage destination for stated archive need, so this option would solve an adjacent identity problem rather than the documented gap.

Answer D is incorrect because This action is appropriate when the requirement is the appropriate audit log for directory configuration change. The scenario instead requires the appropriate storage destination for stated archive need, so this option would solve an adjacent identity problem rather than the documented gap.

Answer E is incorrect because This action is appropriate when the requirement is prioritization of Identity Secure Score recommendation by exposure. The scenario instead requires the appropriate storage destination for stated archive need, so this option would solve an adjacent identity problem rather than the documented gap.

 

Question 11

A change request for a SIEM that consumes a streaming identity event feed will be accepted only when the following is true: the appropriate Event Hubs destination for external event consumer. The tenant has the licensing required for the named capability. Which action best satisfies the requirement?

1. Use Microsoft Entra workbooks when the requirement is a reusable visualization built from identity telemetry.
2. Use sign-in, audit, provisioning, diagnostic, KQL, workbook, and reporting evidence to distinguish score improvement from proof of protection.
3. Join the relevant identity events in KQL using validated identifiers and compatible time windows.
4. Send logs to Azure Event Hubs when a streaming integration or external SIEM pipeline requires event delivery.
5. Use Microsoft Entra provisioning logs for application or cross-tenant provisioning operations and failures.

Correct Answer: D

 

Correct Answer

Answer D is correct because This action directly provides the appropriate Event Hubs destination for external event consumer. It changes the control that owns the stated requirement while preserving unrelated access and can be verified with Microsoft Entra evidence.

Incorrect Answers

Answer A is incorrect because This action is appropriate when the requirement is the appropriate workbook for relevant identity monitoring scenario. The scenario instead requires the appropriate Event Hubs destination for external event consumer, so this option would solve an adjacent identity problem rather than the documented gap.

Answer B is incorrect because This action is appropriate when the requirement is a clear distinction between score improvement and proof of protection. The scenario instead requires the appropriate Event Hubs destination for external event consumer, so this option would solve an adjacent identity problem rather than the documented gap.

Answer C is incorrect because This action is appropriate when the requirement is joining of relevant events using validated identifiers. The scenario instead requires the appropriate Event Hubs destination for external event consumer, so this option would solve an adjacent identity problem rather than the documented gap.

Answer E is incorrect because This action is appropriate when the requirement is the appropriate provisioning log for synchronization failure. The scenario instead requires the appropriate Event Hubs destination for external event consumer, so this option would solve an adjacent identity problem rather than the documented gap.

 

Question 12

The implementation of an identity monitoring investigation is complete except for this requirement: enablement of required log categories without assuming defaults. The correction must address the named control boundary rather than reset unrelated tenant settings. Choose TWO actions that together implement and verify the requirement.

1. Use Microsoft Entra workbooks when the requirement is a reusable visualization built from identity telemetry.
2. Enable required log categories without assuming defaults for only the intended scope in Microsoft Entra monitoring.
3. Use the sign-in log record type and client context to distinguish interactive from noninteractive authentication activity.
4. Recheck the Identity Secure Score recommendation after the configuration change and allow for evaluation/refresh timing before closing it.
5. Query the selected log destination and verify the expected records, fields, and time range before relying on the report.
6. Parse and handle the dynamic Conditional Access fields explicitly in the KQL query before filtering or aggregating them.

Correct Answers: B, E

 

Correct Answers

Answer B is correct because This action directly provides enablement of required log categories without assuming defaults at the correct Microsoft Entra control boundary.

Answer E is correct because This verification step confirms that the selected control changes effective behavior for the intended pilot and exposes policy, assignment, propagation, or evidence problems before wider rollout.

Incorrect Answers

Answer A is incorrect because This action is appropriate when the requirement is the required setting for workbook time range and required data source. It does not implement or verify enablement of required log categories without assuming defaults in this scenario.

Answer C is incorrect because This action is appropriate when the requirement is a clear distinction between interactive and noninteractive sign-in records. It does not implement or verify enablement of required log categories without assuming defaults in this scenario.

Answer D is incorrect because This action is appropriate when the requirement is validation of recommendation status after configuration change. It does not implement or verify enablement of required log categories without assuming defaults in this scenario.

Answer F is incorrect because This action is appropriate when the requirement is handling of dynamic conditional-access fields safely. It does not implement or verify enablement of required log categories without assuming defaults in this scenario.

 

Question 13

The support team has ruled out unrelated causes in a diagnostic setting exporting Microsoft Entra logs. The remaining issue is: diagnosis of missing export from diagnostic setting or destination. No new standing administrator privilege may be introduced. Which action best satisfies the requirement?

1. Use sign-in, audit, provisioning, diagnostic, KQL, workbook, and reporting evidence to diagnose missing export from diagnostic setting or destination.
2. Use Identity Secure Score as posture guidance, not proof that all residual identity risk has been eliminated.
3. Treat a workbook trend as observational evidence and corroborate it before attributing a cause.
4. Use the event timestamp for the investigation window and treat ingestion time as a separate pipeline characteristic.
5. Correlate user and application identifiers across events using sign-in, audit, provisioning, diagnostic, KQL, workbook, and reporting evidence before deciding on remediation.

Correct Answer: A

 

Correct Answer

Answer A is correct because This action directly provides diagnosis of missing export from diagnostic setting or destination. It changes the control that owns the stated requirement while preserving unrelated access and can be verified with Microsoft Entra evidence.

Incorrect Answers

Answer B is incorrect because This action is appropriate when the requirement is an explanation of remaining risk despite higher posture score. The scenario instead requires diagnosis of missing export from diagnostic setting or destination, so this option would solve an adjacent identity problem rather than the documented gap.

Answer C is incorrect because This action is appropriate when the requirement is correct interpretation of trend without assuming causality. The scenario instead requires diagnosis of missing export from diagnostic setting or destination, so this option would solve an adjacent identity problem rather than the documented gap.

Answer D is incorrect because This action is appropriate when the requirement is a clear distinction between event time and ingestion delay. The scenario instead requires diagnosis of missing export from diagnostic setting or destination, so this option would solve an adjacent identity problem rather than the documented gap.

Answer E is incorrect because This action is appropriate when the requirement is correlate user and application identifiers across events. The scenario instead requires diagnosis of missing export from diagnostic setting or destination, so this option would solve an adjacent identity problem rather than the documented gap.

 

Question 14

A readiness check of an authentication failure being investigated leaves one unresolved condition: filtering of sign-ins by time window and result. General network connectivity outside the identity path is already verified. Which action best satisfies the requirement?

1. Use Microsoft Entra workbooks when the requirement is a reusable visualization built from identity telemetry.
2. Use the Conditional Access details in Microsoft Entra sign-in logs to identify which policy and control produced the sign-in result.
3. Use Microsoft Entra sign-in logs for authentication, Conditional Access, client, and sign-in-result evidence.
4. Use KQL or the sign-in log filters to limit records to the stated time window and sign-in result.
5. Handle null or missing fields explicitly in KQL and avoid treating absence as proof of a successful or failed control.

Correct Answer: D

 

Correct Answer

Answer D is correct because This action directly provides filtering of sign-ins by time window and result. It changes the control that owns the stated requirement while preserving unrelated access and can be verified with Microsoft Entra evidence.

Incorrect Answers

Answer A is incorrect because This action is appropriate when the requirement is diagnosis of workbook permissions versus missing telemetry. The scenario instead requires filtering of sign-ins by time window and result, so this option would solve an adjacent identity problem rather than the documented gap.

Answer B is incorrect because This action is appropriate when the requirement is diagnosis of conditional-access result within sign-in details. The scenario instead requires filtering of sign-ins by time window and result, so this option would solve an adjacent identity problem rather than the documented gap.

Answer C is incorrect because This action is appropriate when the requirement is the appropriate sign-in log for authentication failure evidence. The scenario instead requires filtering of sign-ins by time window and result, so this option would solve an adjacent identity problem rather than the documented gap.

Answer E is incorrect because This action is appropriate when the requirement is correct interpretation of null or missing fields without false conclusions. The scenario instead requires filtering of sign-ins by time window and result, so this option would solve an adjacent identity problem rather than the documented gap.

 

Question 15

Testing of an authentication failure being investigated is successful except for this condition: a summary of failed sign-ins by user and application. Resource permissions outside the identity control are already correct. Which action best satisfies the requirement?

1. Use KQL in Log Analytics to summarize failed Microsoft Entra sign-ins by user and application over the defined time window.
2. Use Microsoft Entra audit logs for directory configuration and object-change evidence.
3. Compare the KQL result to the explicitly defined investigation population and denominator before drawing conclusions.
4. Use provisioning logs to confirm whether provisioning succeeded, then check the target application separately for resource authorization.
5. Use Identity Secure Score recommendations to identify posture improvements, then validate each recommendation against the tenant’s requirements.

Correct Answer: A

 

Correct Answer

Answer A is correct because This action directly provides a summary of failed sign-ins by user and application. It changes the control that owns the stated requirement while preserving unrelated access and can be verified with Microsoft Entra evidence.

Incorrect Answers

Answer B is incorrect because This action is appropriate when the requirement is the appropriate audit log for directory configuration change. The scenario instead requires a summary of failed sign-ins by user and application, so this option would solve an adjacent identity problem rather than the documented gap.

Answer C is incorrect because This action is appropriate when the requirement is comparison of query result with defined investigation population. The scenario instead requires a summary of failed sign-ins by user and application, so this option would solve an adjacent identity problem rather than the documented gap.

Answer D is incorrect because This action is appropriate when the requirement is correct interpretation of provisioning status versus target-system access. The scenario instead requires a summary of failed sign-ins by user and application, so this option would solve an adjacent identity problem rather than the documented gap.

Answer E is incorrect because This action is appropriate when the requirement is prioritization of Identity Secure Score recommendation by exposure. The scenario instead requires a summary of failed sign-ins by user and application, so this option would solve an adjacent identity problem rather than the documented gap.

 

Question 16

The organization wants the least-disruptive correction to an identity monitoring investigation. It must provide: joining of relevant events using validated identifiers. The administrator must verify the effective result from Microsoft Entra evidence. Which action best satisfies the requirement?

1. Assign the least-privilege Microsoft Entra monitoring/log-reader role that permits the required investigation without broader directory administration.
2. Use Microsoft Entra provisioning logs for application or cross-tenant provisioning operations and failures.
3. Join the relevant identity events in KQL using validated identifiers and compatible time windows.
4. Use sign-in, audit, provisioning, diagnostic, KQL, workbook, and reporting evidence to distinguish score improvement from proof of protection.
5. Use Microsoft Entra workbooks when the requirement is a reusable visualization built from identity telemetry.

Correct Answer: C

 

Correct Answer

Answer C is correct because This action directly provides joining of relevant events using validated identifiers. It changes the control that owns the stated requirement while preserving unrelated access and can be verified with Microsoft Entra evidence.

Incorrect Answers

Answer A is incorrect because This action is appropriate when the requirement is application of least-privilege log-reader role for investigation. The scenario instead requires joining of relevant events using validated identifiers, so this option would solve an adjacent identity problem rather than the documented gap.

Answer B is incorrect because This action is appropriate when the requirement is the appropriate provisioning log for synchronization failure. The scenario instead requires joining of relevant events using validated identifiers, so this option would solve an adjacent identity problem rather than the documented gap.

Answer D is incorrect because This action is appropriate when the requirement is a clear distinction between score improvement and proof of protection. The scenario instead requires joining of relevant events using validated identifiers, so this option would solve an adjacent identity problem rather than the documented gap.

Answer E is incorrect because This action is appropriate when the requirement is the appropriate workbook for relevant identity monitoring scenario. The scenario instead requires joining of relevant events using validated identifiers, so this option would solve an adjacent identity problem rather than the documented gap.

 

Question 17

A design review of an identity monitoring investigation identifies one remaining requirement: handling of dynamic conditional-access fields safely. The organization requires a supported Microsoft-managed control. Which action best satisfies the requirement?

1. Parse and handle the dynamic Conditional Access fields explicitly in the KQL query before filtering or aggregating them.
2. Recheck the Identity Secure Score recommendation after the configuration change and allow for evaluation/refresh timing before closing it.
3. Use Microsoft Entra workbooks when the requirement is a reusable visualization built from identity telemetry.
4. Use the sign-in log record type and client context to distinguish interactive from noninteractive authentication activity.
5. Send logs to a Log Analytics workspace when KQL querying, correlation, and retained analytics are required.

Correct Answer: A

 

Correct Answer

Answer A is correct because This action directly provides handling of dynamic conditional-access fields safely. It changes the control that owns the stated requirement while preserving unrelated access and can be verified with Microsoft Entra evidence.

Incorrect Answers

Answer B is incorrect because This action is appropriate when the requirement is validation of recommendation status after configuration change. The scenario instead requires handling of dynamic conditional-access fields safely, so this option would solve an adjacent identity problem rather than the documented gap.

Answer C is incorrect because This action is appropriate when the requirement is the required setting for workbook time range and required data source. The scenario instead requires handling of dynamic conditional-access fields safely, so this option would solve an adjacent identity problem rather than the documented gap.

Answer D is incorrect because This action is appropriate when the requirement is a clear distinction between interactive and noninteractive sign-in records. The scenario instead requires handling of dynamic conditional-access fields safely, so this option would solve an adjacent identity problem rather than the documented gap.

Answer E is incorrect because This action is appropriate when the requirement is the appropriate Log Analytics destination for query requirement. The scenario instead requires handling of dynamic conditional-access fields safely, so this option would solve an adjacent identity problem rather than the documented gap.

 

Question 18

Current evidence from an identity monitoring investigation shows that this requirement is not yet met: a clear distinction between event time and ingestion delay. The current population and assignment scope must be preserved. Choose TWO actions that together implement and verify the requirement.

1. Use Identity Secure Score as posture guidance, not proof that all residual identity risk has been eliminated.
2. Send the required Microsoft Entra diagnostic logs to an Azure Storage account when long-term archival retention is the primary requirement.
3. Treat a workbook trend as observational evidence and corroborate it before attributing a cause.
4. Query the selected log destination and verify the expected records, fields, and time range before relying on the report.
5. Use the event timestamp for the investigation window and treat ingestion time as a separate pipeline characteristic.
6. Correlate user and application identifiers across events using sign-in, audit, provisioning, diagnostic, KQL, workbook, and reporting evidence before deciding on remediation.

Correct Answers: D, E

 

Correct Answers

Answer D is correct because This verification step confirms that the selected control changes effective behavior for the intended pilot and exposes policy, assignment, propagation, or evidence problems before wider rollout.

Answer E is correct because This action directly provides a clear distinction between event time and ingestion delay at the correct Microsoft Entra control boundary.

Incorrect Answers

Answer A is incorrect because This action is appropriate when the requirement is an explanation of remaining risk despite higher posture score. It does not implement or verify a clear distinction between event time and ingestion delay in this scenario.

Answer B is incorrect because This action is appropriate when the requirement is the appropriate storage destination for stated archive need. It does not implement or verify a clear distinction between event time and ingestion delay in this scenario.

Answer C is incorrect because This action is appropriate when the requirement is correct interpretation of trend without assuming causality. It does not implement or verify a clear distinction between event time and ingestion delay in this scenario.

Answer F is incorrect because This action is appropriate when the requirement is correlate user and application identifiers across events. It does not implement or verify a clear distinction between event time and ingestion delay in this scenario.

 

Question 19

Before expanding an identity monitoring investigation, the administrator must satisfy this condition: correct interpretation of null or missing fields without false conclusions. Existing working access outside the stated scope must remain unchanged. Which action best satisfies the requirement?

1. Use Microsoft Entra sign-in logs for authentication, Conditional Access, client, and sign-in-result evidence.
2. Use Microsoft Entra workbooks when the requirement is a reusable visualization built from identity telemetry.
3. Handle null or missing fields explicitly in KQL and avoid treating absence as proof of a successful or failed control.
4. Use the Conditional Access details in Microsoft Entra sign-in logs to identify which policy and control produced the sign-in result.
5. Send logs to Azure Event Hubs when a streaming integration or external SIEM pipeline requires event delivery.

Correct Answer: C

 

Correct Answer

Answer C is correct because This action directly provides correct interpretation of null or missing fields without false conclusions. It changes the control that owns the stated requirement while preserving unrelated access and can be verified with Microsoft Entra evidence.

Incorrect Answers

Answer A is incorrect because This action is appropriate when the requirement is the appropriate sign-in log for authentication failure evidence. The scenario instead requires correct interpretation of null or missing fields without false conclusions, so this option would solve an adjacent identity problem rather than the documented gap.

Answer B is incorrect because This action is appropriate when the requirement is diagnosis of workbook permissions versus missing telemetry. The scenario instead requires correct interpretation of null or missing fields without false conclusions, so this option would solve an adjacent identity problem rather than the documented gap.

Answer D is incorrect because This action is appropriate when the requirement is diagnosis of conditional-access result within sign-in details. The scenario instead requires correct interpretation of null or missing fields without false conclusions, so this option would solve an adjacent identity problem rather than the documented gap.

Answer E is incorrect because This action is appropriate when the requirement is the appropriate Event Hubs destination for external event consumer. The scenario instead requires correct interpretation of null or missing fields without false conclusions, so this option would solve an adjacent identity problem rather than the documented gap.

 

Question 20

The administrator is preparing an identity monitoring investigation for production. The required condition is: comparison of query result with defined investigation population. The change will be piloted before broader enforcement. Which action best satisfies the requirement?

1. Use Identity Secure Score recommendations to identify posture improvements, then validate each recommendation against the tenant’s requirements.
2. Use Microsoft Entra audit logs for directory configuration and object-change evidence.
3. Use provisioning logs to confirm whether provisioning succeeded, then check the target application separately for resource authorization.
4. Compare the KQL result to the explicitly defined investigation population and denominator before drawing conclusions.
5. Enable required log categories without assuming defaults for only the intended scope in Microsoft Entra monitoring.

Correct Answer: D

 

Correct Answer

Answer D is correct because This action directly provides comparison of query result with defined investigation population. It changes the control that owns the stated requirement while preserving unrelated access and can be verified with Microsoft Entra evidence.

Incorrect Answers

Answer A is incorrect because This action is appropriate when the requirement is prioritization of Identity Secure Score recommendation by exposure. The scenario instead requires comparison of query result with defined investigation population, so this option would solve an adjacent identity problem rather than the documented gap.

Answer B is incorrect because This action is appropriate when the requirement is the appropriate audit log for directory configuration change. The scenario instead requires comparison of query result with defined investigation population, so this option would solve an adjacent identity problem rather than the documented gap.

Answer C is incorrect because This action is appropriate when the requirement is correct interpretation of provisioning status versus target-system access. The scenario instead requires comparison of query result with defined investigation population, so this option would solve an adjacent identity problem rather than the documented gap.

Answer E is incorrect because This action is appropriate when the requirement is enablement of required log categories without assuming defaults. The scenario instead requires comparison of query result with defined investigation population, so this option would solve an adjacent identity problem rather than the documented gap.

 

Question 21

A production issue involving a reusable identity-monitoring workbook has been narrowed to this requirement: the appropriate workbook for relevant identity monitoring scenario. The tenant has the licensing required for the named capability. Which action best satisfies the requirement?

1. Use sign-in, audit, provisioning, diagnostic, KQL, workbook, and reporting evidence to diagnose missing export from diagnostic setting or destination.
2. Use Microsoft Entra provisioning logs for application or cross-tenant provisioning operations and failures.
3. Assign the least-privilege Microsoft Entra monitoring/log-reader role that permits the required investigation without broader directory administration.
4. Use Microsoft Entra workbooks when the requirement is a reusable visualization built from identity telemetry.
5. Use sign-in, audit, provisioning, diagnostic, KQL, workbook, and reporting evidence to distinguish score improvement from proof of protection.

Correct Answer: D

 

Correct Answer

Answer D is correct because This action directly provides the appropriate workbook for relevant identity monitoring scenario. It changes the control that owns the stated requirement while preserving unrelated access and can be verified with Microsoft Entra evidence.

Incorrect Answers

Answer A is incorrect because This action is appropriate when the requirement is diagnosis of missing export from diagnostic setting or destination. The scenario instead requires the appropriate workbook for relevant identity monitoring scenario, so this option would solve an adjacent identity problem rather than the documented gap.

Answer B is incorrect because This action is appropriate when the requirement is the appropriate provisioning log for synchronization failure. The scenario instead requires the appropriate workbook for relevant identity monitoring scenario, so this option would solve an adjacent identity problem rather than the documented gap.

Answer C is incorrect because This action is appropriate when the requirement is application of least-privilege log-reader role for investigation. The scenario instead requires the appropriate workbook for relevant identity monitoring scenario, so this option would solve an adjacent identity problem rather than the documented gap.

Answer E is incorrect because This action is appropriate when the requirement is a clear distinction between score improvement and proof of protection. The scenario instead requires the appropriate workbook for relevant identity monitoring scenario, so this option would solve an adjacent identity problem rather than the documented gap.

 

Question 22

The security review of a reusable identity-monitoring workbook focuses on one acceptance criterion: the required setting for workbook time range and required data source. The correction must address the named control boundary rather than reset unrelated tenant settings. Which action best satisfies the requirement?

1. Use the sign-in log record type and client context to distinguish interactive from noninteractive authentication activity.
2. Send logs to a Log Analytics workspace when KQL querying, correlation, and retained analytics are required.
3. Use KQL or the sign-in log filters to limit records to the stated time window and sign-in result.
4. Recheck the Identity Secure Score recommendation after the configuration change and allow for evaluation/refresh timing before closing it.
5. Configure the workbook to use the required identity data source and investigation time range so its visualizations represent the intended population.

Correct Answer: E

 

Correct Answer

Answer E is correct because This option directly tests set workbook time range and required data source at the control boundary named in the scenario. It addresses that specific stage or distinction rather than collapsing it into a neighboring workflow step.

Incorrect Answers

Answer A is incorrect because This action is appropriate when the requirement is a clear distinction between interactive and noninteractive sign-in records. The scenario instead requires the required setting for workbook time range and required data source, so this option would solve an adjacent identity problem rather than the documented gap.

Answer B is incorrect because This action is appropriate when the requirement is the appropriate Log Analytics destination for query requirement. The scenario instead requires the required setting for workbook time range and required data source, so this option would solve an adjacent identity problem rather than the documented gap.

Answer C is incorrect because This action is appropriate when the requirement is filtering of sign-ins by time window and result. The scenario instead requires the required setting for workbook time range and required data source, so this option would solve an adjacent identity problem rather than the documented gap.

Answer D is incorrect because This action is appropriate when the requirement is validation of recommendation status after configuration change. The scenario instead requires the required setting for workbook time range and required data source, so this option would solve an adjacent identity problem rather than the documented gap.

 

Question 23

The team is validating an identity monitoring investigation. The decisive requirement is: correct interpretation of trend without assuming causality. No new standing administrator privilege may be introduced. Which action best satisfies the requirement?

1. Send the required Microsoft Entra diagnostic logs to an Azure Storage account when long-term archival retention is the primary requirement.
2. Use KQL in Log Analytics to summarize failed Microsoft Entra sign-ins by user and application over the defined time window.
3. Correlate user and application identifiers across events using sign-in, audit, provisioning, diagnostic, KQL, workbook, and reporting evidence before deciding on remediation.
4. Use Identity Secure Score as posture guidance, not proof that all residual identity risk has been eliminated.
5. Treat a workbook trend as observational evidence and corroborate it before attributing a cause.

Correct Answer: E

 

Correct Answer

Answer E is correct because This action directly provides correct interpretation of trend without assuming causality. It changes the control that owns the stated requirement while preserving unrelated access and can be verified with Microsoft Entra evidence.

Incorrect Answers

Answer A is incorrect because This action is appropriate when the requirement is the appropriate storage destination for stated archive need. The scenario instead requires correct interpretation of trend without assuming causality, so this option would solve an adjacent identity problem rather than the documented gap.

Answer B is incorrect because This action is appropriate when the requirement is a summary of failed sign-ins by user and application. The scenario instead requires correct interpretation of trend without assuming causality, so this option would solve an adjacent identity problem rather than the documented gap.

Answer C is incorrect because This action is appropriate when the requirement is correlate user and application identifiers across events. The scenario instead requires correct interpretation of trend without assuming causality, so this option would solve an adjacent identity problem rather than the documented gap.

Answer D is incorrect because This action is appropriate when the requirement is an explanation of remaining risk despite higher posture score. The scenario instead requires correct interpretation of trend without assuming causality, so this option would solve an adjacent identity problem rather than the documented gap.

 

Question 24

Operations staff investigating a reusable identity-monitoring workbook have isolated the issue to: diagnosis of workbook permissions versus missing telemetry. General network connectivity outside the identity path is already verified. Choose TWO actions that together implement and verify the requirement.

1. Use Microsoft Entra workbooks when the requirement is a reusable visualization built from identity telemetry.
2. Query the selected log destination and verify the expected records, fields, and time range before relying on the report.
3. Send logs to Azure Event Hubs when a streaming integration or external SIEM pipeline requires event delivery.
4. Use Microsoft Entra sign-in logs for authentication, Conditional Access, client, and sign-in-result evidence.
5. Join the relevant identity events in KQL using validated identifiers and compatible time windows.
6. Use the Conditional Access details in Microsoft Entra sign-in logs to identify which policy and control produced the sign-in result.

Correct Answers: A, B

 

Correct Answers

Answer A is correct because This action directly provides diagnosis of workbook permissions versus missing telemetry at the correct Microsoft Entra control boundary.

Answer B is correct because This verification step confirms that the selected control changes effective behavior for the intended pilot and exposes policy, assignment, propagation, or evidence problems before wider rollout.

Incorrect Answers

Answer C is incorrect because This action is appropriate when the requirement is the appropriate Event Hubs destination for external event consumer. It does not implement or verify diagnosis of workbook permissions versus missing telemetry in this scenario.

Answer D is incorrect because This action is appropriate when the requirement is the appropriate sign-in log for authentication failure evidence. It does not implement or verify diagnosis of workbook permissions versus missing telemetry in this scenario.

Answer E is incorrect because This action is appropriate when the requirement is joining of relevant events using validated identifiers. It does not implement or verify diagnosis of workbook permissions versus missing telemetry in this scenario.

Answer F is incorrect because This action is appropriate when the requirement is diagnosis of conditional-access result within sign-in details. It does not implement or verify diagnosis of workbook permissions versus missing telemetry in this scenario.

 

Question 25

The administrator must correct an Identity Secure Score recommendation under review without changing adjacent controls. The target condition is: prioritization of Identity Secure Score recommendation by exposure. Resource permissions outside the identity control are already correct. Which action best satisfies the requirement?

1. Use Identity Secure Score recommendations to identify posture improvements, then validate each recommendation against the tenant’s requirements.
2. Enable required log categories without assuming defaults for only the intended scope in Microsoft Entra monitoring.
3. Use provisioning logs to confirm whether provisioning succeeded, then check the target application separately for resource authorization.
4. Parse and handle the dynamic Conditional Access fields explicitly in the KQL query before filtering or aggregating them.
5. Use Microsoft Entra audit logs for directory configuration and object-change evidence.

Correct Answer: A

 

Correct Answer

Answer A is correct because This action directly provides prioritization of Identity Secure Score recommendation by exposure. It changes the control that owns the stated requirement while preserving unrelated access and can be verified with Microsoft Entra evidence.

Incorrect Answers

Answer B is incorrect because This action is appropriate when the requirement is enablement of required log categories without assuming defaults. The scenario instead requires prioritization of Identity Secure Score recommendation by exposure, so this option would solve an adjacent identity problem rather than the documented gap.

Answer C is incorrect because This action is appropriate when the requirement is correct interpretation of provisioning status versus target-system access. The scenario instead requires prioritization of Identity Secure Score recommendation by exposure, so this option would solve an adjacent identity problem rather than the documented gap.

Answer D is incorrect because This action is appropriate when the requirement is handling of dynamic conditional-access fields safely. The scenario instead requires prioritization of Identity Secure Score recommendation by exposure, so this option would solve an adjacent identity problem rather than the documented gap.

Answer E is incorrect because This action is appropriate when the requirement is the appropriate audit log for directory configuration change. The scenario instead requires prioritization of Identity Secure Score recommendation by exposure, so this option would solve an adjacent identity problem rather than the documented gap.

 

Question 26

An audit of an identity monitoring investigation identifies this control gap: a clear distinction between score improvement and proof of protection. The administrator must verify the effective result from Microsoft Entra evidence. Which action best satisfies the requirement?

1. Use sign-in, audit, provisioning, diagnostic, KQL, workbook, and reporting evidence to distinguish score improvement from proof of protection.
2. Use the event timestamp for the investigation window and treat ingestion time as a separate pipeline characteristic.
3. Assign the least-privilege Microsoft Entra monitoring/log-reader role that permits the required investigation without broader directory administration.
4. Use Microsoft Entra provisioning logs for application or cross-tenant provisioning operations and failures.
5. Use sign-in, audit, provisioning, diagnostic, KQL, workbook, and reporting evidence to diagnose missing export from diagnostic setting or destination.

Correct Answer: A

 

Correct Answer

Answer A is correct because This action directly provides a clear distinction between score improvement and proof of protection. It changes the control that owns the stated requirement while preserving unrelated access and can be verified with Microsoft Entra evidence.

Incorrect Answers

Answer B is incorrect because This action is appropriate when the requirement is a clear distinction between event time and ingestion delay. The scenario instead requires a clear distinction between score improvement and proof of protection, so this option would solve an adjacent identity problem rather than the documented gap.

Answer C is incorrect because This action is appropriate when the requirement is application of least-privilege log-reader role for investigation. The scenario instead requires a clear distinction between score improvement and proof of protection, so this option would solve an adjacent identity problem rather than the documented gap.

Answer D is incorrect because This action is appropriate when the requirement is the appropriate provisioning log for synchronization failure. The scenario instead requires a clear distinction between score improvement and proof of protection, so this option would solve an adjacent identity problem rather than the documented gap.

Answer E is incorrect because This action is appropriate when the requirement is diagnosis of missing export from diagnostic setting or destination. The scenario instead requires a clear distinction between score improvement and proof of protection, so this option would solve an adjacent identity problem rather than the documented gap.

 

Question 27

The documented success criterion for an identity monitoring investigation is: validation of recommendation status after configuration change. The organization requires a supported Microsoft-managed control. Which action best satisfies the requirement?

1. Use KQL or the sign-in log filters to limit records to the stated time window and sign-in result.
2. Send logs to a Log Analytics workspace when KQL querying, correlation, and retained analytics are required.
3. Handle null or missing fields explicitly in KQL and avoid treating absence as proof of a successful or failed control.
4. Recheck the Identity Secure Score recommendation after the configuration change and allow for evaluation/refresh timing before closing it.
5. Use the sign-in log record type and client context to distinguish interactive from noninteractive authentication activity.

Correct Answer: D

 

Correct Answer

Answer D is correct because This action directly provides validation of recommendation status after configuration change. It changes the control that owns the stated requirement while preserving unrelated access and can be verified with Microsoft Entra evidence.

Incorrect Answers

Answer A is incorrect because This action is appropriate when the requirement is filtering of sign-ins by time window and result. The scenario instead requires validation of recommendation status after configuration change, so this option would solve an adjacent identity problem rather than the documented gap.

Answer B is incorrect because This action is appropriate when the requirement is the appropriate Log Analytics destination for query requirement. The scenario instead requires validation of recommendation status after configuration change, so this option would solve an adjacent identity problem rather than the documented gap.

Answer C is incorrect because This action is appropriate when the requirement is correct interpretation of null or missing fields without false conclusions. The scenario instead requires validation of recommendation status after configuration change, so this option would solve an adjacent identity problem rather than the documented gap.

Answer E is incorrect because This action is appropriate when the requirement is a clear distinction between interactive and noninteractive sign-in records. The scenario instead requires validation of recommendation status after configuration change, so this option would solve an adjacent identity problem rather than the documented gap.

 

Question 28

The current configuration of an identity monitoring investigation is otherwise acceptable. The unresolved requirement is: an explanation of remaining risk despite higher posture score. The current population and assignment scope must be preserved. Which action best satisfies the requirement?

1. Use Identity Secure Score as posture guidance, not proof that all residual identity risk has been eliminated.
2. Use KQL in Log Analytics to summarize failed Microsoft Entra sign-ins by user and application over the defined time window.
3. Compare the KQL result to the explicitly defined investigation population and denominator before drawing conclusions.
4. Send the required Microsoft Entra diagnostic logs to an Azure Storage account when long-term archival retention is the primary requirement.
5. Correlate user and application identifiers across events using sign-in, audit, provisioning, diagnostic, KQL, workbook, and reporting evidence before deciding on remediation.

Correct Answer: A

 

Correct Answer

Answer A is correct because This action directly provides an explanation of remaining risk despite higher posture score. It changes the control that owns the stated requirement while preserving unrelated access and can be verified with Microsoft Entra evidence.

Incorrect Answers

Answer B is incorrect because This action is appropriate when the requirement is a summary of failed sign-ins by user and application. The scenario instead requires an explanation of remaining risk despite higher posture score, so this option would solve an adjacent identity problem rather than the documented gap.

Answer C is incorrect because This action is appropriate when the requirement is comparison of query result with defined investigation population. The scenario instead requires an explanation of remaining risk despite higher posture score, so this option would solve an adjacent identity problem rather than the documented gap.

Answer D is incorrect because This action is appropriate when the requirement is the appropriate storage destination for stated archive need. The scenario instead requires an explanation of remaining risk despite higher posture score, so this option would solve an adjacent identity problem rather than the documented gap.

Answer E is incorrect because This action is appropriate when the requirement is correlate user and application identifiers across events. The scenario instead requires an explanation of remaining risk despite higher posture score, so this option would solve an adjacent identity problem rather than the documented gap.