MS Microsoft Defender for Cloud Apps & Defender for Identity

Question 1

How can Microsoft Defender for Cloud Apps discover unsanctioned (shadow IT) cloud apps used in your organization?

Accepted Answer

By analyzing traffic logs from firewalls and proxies or Defender for Endpoint signals in Cloud Discovery

Answer

Cloud Discovery analyzes uploaded traffic logs from firewalls and proxies, or data forwarded by Defender for Endpoint-onboarded devices. It identifies the cloud apps in use and scores their risk.

Question 2

Where is the Microsoft Defender for Identity sensor installed to monitor on-premises Active Directory?

Accepted Answer

On domain controllers

Answer

The Defender for Identity sensor is installed on domain controllers (and AD FS / AD CS servers). It monitors network traffic and events to detect identity-based threats.

Question 3

You want to monitor and restrict a user's actions in a browser session, such as blocking file downloads from unmanaged devices. Which combination enables this?

Accepted Answer

Conditional Access App Control with a Defender for Cloud Apps session policy

Answer

A Conditional Access policy can route sessions to Defender for Cloud Apps through Conditional Access App Control. A session policy then monitors and controls activities such as downloads in real time.

Question 4

Which type of Defender for Cloud Apps policy can detect files shared publicly that contain sensitive information and automatically apply a remediation such as removing the sharing permission?

Accepted Answer

File policy

Answer

File policies scan files in connected apps for conditions such as sharing level or sensitive content. They can apply governance actions, such as removing external sharing or quarantining files.

Question 5

Which of the following threats is Defender for Identity designed to detect?

Accepted Answer

Pass-the-hash and lateral movement paths in Active Directory

Answer

Defender for Identity detects identity-based attacks such as pass-the-hash, pass-the-ticket, Kerberoasting, reconnaissance, and lateral movement path exposure within on-premises AD environments.

(MS-102) Microsoft 365 Administrator Expert Practice Test

(MS-102) Microsoft 365 Administrator Expert Practice Test

MS Microsoft Defender for Cloud Apps & Defender for Identity