Practice question 28 of 498 · hard
A security program owns endpoint protection, identity governance, and a SIEM, but a simulated compromised identity reaches sensitive data without triggering coordinated containment. Which architectural action is most appropriate?
Choose the single best answer.
Show the answer and explanation
✓ Correct answer
- Map the attack path to controls, verify telemetry and enforcement integrations, and assign response ownership
Map the attack path to controls, verify telemetry and enforcement integrations, and assign response ownership: The gap is in effective end-to-end coverage and response, not merely product ownership. Treat product licenses as proof that the path is covered: Ownership does not establish functioning integration or enforcement. Remove identity controls because endpoint software already exists: The attack path spans identity and data, requiring complementary controls. Increase the SIEM retention period as the sole remedy: Retention helps later investigation but does not by itself add missing containment or authorization.
Read and review here, or open the app to practise and save your results on this device.
Unofficial study material. Not affiliated with or endorsed by Microsoft. These are original learning questions, not actual exam questions. Product capabilities and exam objectives can change; verify current Microsoft documentation. Practice scores do not predict or guarantee an exam result.