Threat Protection & Security Operations Flashcards

Which Microsoft Defender for Cloud Apps feature discovers unsanctioned cloud applications used by employees?

Answer: Cloud Discovery

Cloud Discovery analyzes network traffic logs to identify cloud apps being used by employees, revealing shadow IT in the organization.

An admin wants to block downloads of sensitive files from unmanaged devices in real time. Which feature enables this?

Answer: Conditional Access App Control in Defender for Cloud Apps

Conditional Access App Control uses reverse proxy to monitor and control session activity in real time, including blocking downloads on unmanaged devices.

What severity level should an organization assign when configuring Microsoft 365 Defender alert policies for high-impact events?

Answer: High

High-severity alerts should be assigned to events with significant business impact such as mass file deletion or ransomware activity.

Which capability in Microsoft 365 Defender automates investigation and remediation of common threats?

Answer: Automated Investigation and Remediation (AIR)

Automated Investigation and Remediation (AIR) automatically investigates alerts and takes remediation actions such as removing malicious emails or isolating devices.

Which query language is used in Advanced Hunting within Microsoft 365 Defender?

Answer: Kusto Query Language (KQL)

Advanced Hunting uses Kusto Query Language (KQL) to search across 30 days of raw event data for threats and suspicious activity.

What does the 'Threat Analytics' section of Microsoft 365 Defender provide?

Answer: Analyst reports on active threat campaigns and their impact on your organization

Threat Analytics delivers Microsoft security researcher reports on active threat actors and campaigns, including their impact on and coverage across your environment.