Describe the capabilities of Microsoft security solutions →hardMultiple ChoiceObjective-mapped

SC-900 Practice Question: Describe the capabilities of Microsoft security solutions

Exhibit

{
  "alertId": "1234-5678",
  "title": "Malicious File Execution Detected",
  "severity": "High",
  "category": "Malware",
  "entities": [
    {
      "type": "file",
      "name": "invoice.docm",
      "sha256": "abc123..."
    },
    {
      "type": "device",
      "name": "DESKTOP-01"
    },
    {
      "type": "user",
      "name": "jdoe"
    }
  ],
  "investigationState": "Triggered"
}

Refer to the exhibit. The exhibit shows an alert from Microsoft Defender XDR. The security team needs to determine if the file 'invoice.docm' is known malware and if other devices in the organization have this file. What should they do next?

⚠ Common exam trap

A common mix-up: candidates choose 'Trigger the automated investigation' thinking it will automatically determine malware status and scope, but automated investigation focuses on response actions rather than providing the specific hash-based query results needed to answer both questions.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Search in Advanced Hunting for the file's SHA256 hash across all devices

Searching for the file's SHA256 hash in Advanced Hunting allows the security team to query across all devices in the organization to determine if the file is known malware (by cross-referencing with threat intelligence) and to identify which other devices have the same file. Advanced Hunting in Microsoft Defender XDR supports Kusto Query Language (KQL) queries against the DeviceFileEvents table, enabling hash-based file discovery and reputation checks.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Isolate the device DESKTOP-01 immediately
Why it's wrong here
While device isolation is a critical containment action in incident response, performing it immediately without understanding the scope or prevalence of the malicious file could be premature. The initial step should involve assessing whether this file has impacted other endpoints within the organization. A more informed decision regarding isolation can then be made, balancing containment with the need for further investigation and potential disruption.
✗
Trigger the automated investigation for this alert
Why it's wrong here
The exhibit indicates that an automated investigation has already been 'Triggered' for this alert, meaning the system is actively collecting evidence and performing remediation actions. Therefore, attempting to trigger it again would be redundant and would not advance the incident response process. The next logical step would be to review the findings of the ongoing automated investigation or to proactively hunt for further indicators of compromise.
✗
Review the user jdoe's recent activities
Why it's wrong here
While user activity, such as recent logins or file access, can provide valuable context regarding how the malicious file arrived or was executed, the immediate priority following an alert about a specific file is to understand its characteristics and potential spread. Focusing solely on user activities at this stage might divert attention from the more pressing task of identifying all affected systems and containing the threat. The file's behavior and prevalence across devices are more critical initial data points.
✓
Search in Advanced Hunting for the file's SHA256 hash across all devices
Why this is correct
Searching for the file's SHA256 hash in Advanced Hunting is the most effective immediate next step because it allows security analysts to quickly determine the prevalence of the malicious file across the entire organizational environment. Using this unique cryptographic identifier ensures an accurate and comprehensive search, revealing if other endpoints have encountered or executed the same file. This crucial information is essential for understanding the scope of the compromise and prioritizing subsequent containment and eradication efforts.

Go deeper

SC-900 Practice Question: Describe the capabilities of Microsoft security solutions

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question