SY0-701 Question 396
Single answer4.9 Given a scenario, use data sources to support an investigation.A security analyst is investigating a suspected account compromise involving a finance employee. At 2:13 a.m., the employee's account successfully authenticated to Microsoft 365 from an IP address in another country, and within minutes several mailbox forwarding rules were created. The analyst needs to determine whether the login was likely from the legitimate user or from an attacker using stolen credentials. Which data source would provide the MOST direct evidence to validate the physical location and activity of the employee's corporate laptop at the time of the suspicious login?
- A
Endpoint detection and response (EDR) telemetry from the employee's assigned laptop
- B
The employee's annual security awareness training completion record
- C
Vulnerability scan results for the finance subnet from the previous week
- D
The organization's data retention policy for email logs
Show answer and explanation
Correct answer: A
Explanation
When investigating potentially stolen credentials, analysts should correlate identity and cloud-service logs with endpoint, network, and access data sources. In this scenario, Microsoft 365 sign-in activity and mailbox rule creation suggest possible business email compromise. To determine whether the user likely performed the login, the analyst needs a source that can directly show whether the assigned corporate laptop was active and what it was doing at that time. EDR is the best answer because it can provide host telemetry such as user logon events, process execution, network connections, device health, and sometimes geolocation-relevant network context through observed IP usage or VPN activity. Best practice in incident response is to build a timeline from multiple authoritative sources, such as endpoint telemetry, identity provider sign-in logs, VPN logs, DHCP logs, wireless association logs, and physical access/badge records. Guidance from common incident-response practices, including NIST incident handling recommendations, emphasizes collecting and correlating relevant logs and host data to validate hypotheses during an investigation.
- A. Correct.
Correct. EDR telemetry is the most direct source for validating whether the employee's corporate laptop was active, where it was connecting from, what processes were running, and whether there were signs of compromise at the time of the login. In an investigation, endpoint logs can help correlate user activity, device health, network connections, and timestamps with identity-provider and cloud-service events. This is exactly the kind of host-based data source used to support or refute whether the login originated from the legitimate device.
- B. Incorrect.
Incorrect. Security awareness training records may provide administrative context about the employee's compliance status, but they do not provide evidence about the employee's location, device activity, or whether the 2:13 a.m. login came from the corporate laptop. A candidate might choose this because phishing-related investigations sometimes consider user training, but it does not directly validate the event in question.
- C. Incorrect.
Incorrect. Vulnerability scan results can show weaknesses on systems in the finance subnet, but they do not establish where the employee's laptop was physically located or whether it was used during the suspicious authentication. This is a plausible distractor because vulnerability data is useful for broader security posture assessments, but it is not the best investigative source for this specific question.
- D. Incorrect.
Incorrect. A data retention policy explains how long logs are kept and may affect whether evidence is available, but it is not itself an evidentiary data source about the incident. Someone might select this if they are thinking about log availability or compliance requirements, but the question asks for the most direct evidence to validate location and activity.