Microsoft MS-102 Practice Test 45
Question 440
At Riverbend Services, the information governance team is responsible for a sensitive content protection initiative. A sensitivity label exists but employees do not see it in supported Office labeling interfaces. The documented evidence is: the label is configured yet absent from the relevant label policy scope. The required outcome is to make the intended classification label available to the target users. The project requires audit-ready before-and-after configuration records. Before changing the tenant, which diagnostic investigation would most directly verify the suspected cause?
- Review Microsoft Purview Content explorer views for classified items and locations during Riverbend Services' sensitive content protection initiative
- Review current Microsoft Purview retention policies and location scopes during Riverbend Services' sensitive content protection initiative
- Review applicable retention label definitions, publication, and item classification during Riverbend Services' sensitive content protection initiative
- Review Purview sensitivity label policy publication and target user or group scope during Riverbend Services' sensitive content protection initiative
Explanation
Correct Answer
D:Review Purview sensitivity label policy publication and target user or group scope. This investigation step is specific to sensitivity label publication policy. The immediate task is to verify the root cause, not implement a broad remedy. It responds to the evidence that the label is configured yet absent from the relevant label policy scope and advances the required outcome to make the intended classification label available to the target users.
Incorrect Answers
A:Review Microsoft Purview Content explorer views for classified items and locations. This is an investigation step for content explorer classified data inventory, where the compliance manager needs to find where classified sensitive information exists in supported Microsoft 365 content. The current case instead reports that a sensitivity label exists but employees do not see it in supported Office labeling interfaces. It does not directly demonstrate the required outcome to make the intended classification label available to the target users at this decision stage.
B:Review current Microsoft Purview retention policies and location scopes. This is an investigation step for broad microsoft 365 retention policy, where the organization needs a broad baseline retention setting for a defined workload location. The current case instead reports that a sensitivity label exists but employees do not see it in supported Office labeling interfaces. It does not directly demonstrate the required outcome to make the intended classification label available to the target users at this decision stage.
C:Review applicable retention label definitions, publication, and item classification. This is an investigation step for retention labels for individual items, where records officers must retain selected contract documents for a defined period based on content classification. The current case instead reports that a sensitivity label exists but employees do not see it in supported Office labeling interfaces. It does not directly demonstrate the required outcome to make the intended classification label available to the target users at this decision stage.
Question 441
At Granite Consulting, the authentication services team is responsible for a password recovery improvement program. Users repeatedly choose organization-specific easy-to-guess passwords despite conventional complexity checks. The documented evidence is: weak organization terms are not present in the custom banned-password list. The required outcome is to block organization-specific weak password choices. The administrator must retain a rollback path and document evidence of success. Before changing the tenant, which diagnostic investigation would most directly verify the suspected cause?
- Review Password Protection policy and custom banned-password terms during Granite Consulting's password recovery improvement program
- Inspect authentication methods policy targeting and existing passkey or FIDO2 registration during Granite Consulting's password recovery improvement program
- Inspect applicable Conditional Access policies and effective MFA grant controls on admin sign-ins during Granite Consulting's password recovery improvement program
- Inspect the affected Entra sign-in event including authentication details and Conditional Access results during Granite Consulting's password recovery improvement program
Explanation
Correct Answer
A:Review Password Protection policy and custom banned-password terms. This investigation step is specific to microsoft entra password protection. The immediate task is to verify the root cause, not implement a broad remedy. It responds to the evidence that weak organization terms are not present in the custom banned-password list and advances the requested outcome to block organization-specific weak password choices.
Incorrect Answers
B:Inspect authentication methods policy targeting and existing passkey or FIDO2 registration. This is an investigation step for passkey and authentication methods policy, where security wants approved phishing-resistant sign-in methods for administrators. This case instead reports that users repeatedly choose organization-specific easy-to-guess passwords despite conventional complexity checks. It does not directly demonstrate the required outcome to block organization-specific weak password choices at this decision stage.
C:Inspect applicable Conditional Access policies and effective MFA grant controls on admin sign-ins. This is an investigation step for conditional access mfa policy targeting, where admins need MFA enforced centrally for a privileged access cohort. This case instead reports that users repeatedly choose organization-specific easy-to-guess passwords despite conventional complexity checks. It does not directly demonstrate the required outcome to block organization-specific weak password choices at this decision stage.
D:Inspect the affected Entra sign-in event including authentication details and Conditional Access results. This is an investigation step for sign-in log authentication troubleshooting, where a user reports an MFA-related sign-in failure to Microsoft 365. This case instead reports that users repeatedly choose organization-specific easy-to-guess passwords despite conventional complexity checks. It does not directly demonstrate the required outcome to block organization-specific weak password choices at this decision stage.
Question 442
At Bluebird Freight, the authentication services team is responsible for a privileged sign-in assurance rollout. A user reports an MFA-related sign-in failure to Microsoft 365. The documented evidence is: entra sign-in logs contain a failure reason and Conditional Access evaluation detail. The required outcome is to identify the actual sign-in policy or authentication factor causing the block. The change cannot weaken an unrelated control or expand access to uninvolved users. Which configuration or response best meets the specified requirement?
- Set a Conditional Access authentication strength requirement suitable for privileged users during Bluebird Freight's privileged sign-in assurance rollout
- Correct the specific policy or authentication registration issue shown by the sign-in record during Bluebird Freight's privileged sign-in assurance rollout
- Issue a short-lived Temporary Access Pass under the approved authentication methods policy during Bluebird Freight's privileged sign-in assurance rollout
- Enable self-service password reset for the appropriate target group during Bluebird Freight's privileged sign-in assurance rollout
Explanation
Correct Answer
B:Correct the specific policy or authentication registration issue shown by the sign-in record. This solution design step is specific to sign-in log authentication troubleshooting. The immediate task is to select the technical control that matches the observed requirement. It responds to the evidence that entra sign-in logs contain a failure reason and Conditional Access evaluation detail and advances the requested outcome to identify the actual sign-in policy or authentication factor causing the block.
Incorrect Answers
A:Set a Conditional Access authentication strength requirement suitable for privileged users. This is a solution design step for authentication strength requirement, where privileged administrators must use phishing-resistant MFA instead of any two factors. This case instead reports that a user reports an MFA-related sign-in failure to Microsoft 365. It does not directly demonstrate the required outcome to identify the actual sign-in policy or authentication factor causing the block at this decision stage.
C:Issue a short-lived Temporary Access Pass under the approved authentication methods policy. This is a solution design step for temporary access pass bootstrap, where a new employee cannot register strong authentication methods because no usable method is yet available. This case instead reports that a user reports an MFA-related sign-in failure to Microsoft 365. It does not directly demonstrate the required outcome to identify the actual sign-in policy or authentication factor causing the block at this decision stage.
D:Enable self-service password reset for the appropriate target group. This is a solution design step for sspr policy targeting, where a subset of employees should be permitted to reset their passwords without helpdesk tickets. This case instead reports that a user reports an MFA-related sign-in failure to Microsoft 365. It does not directly demonstrate the required outcome to identify the actual sign-in policy or authentication factor causing the block at this decision stage.
Question 443
At Beacon Manufacturing, the workplace administration team is responsible for an employee account lifecycle rollout. Users need core Microsoft 365 services but one licensed service plan must remain disabled for a cohort. The documented evidence is: the assigned subscription contains multiple independently controllable service plans. The required outcome is to apply service-plan configuration to the correct license assignment. Only a named pilot cohort may be changed before the production window. Which post-change check would most directly establish that the requirement has been met?
- Verify the guest redeems the invitation and sees only the shared resources during Beacon Manufacturing's employee account lifecycle rollout
- Confirm members can access the intended group collaboration resources while nonmembers cannot during Beacon Manufacturing's employee account lifecycle rollout
- Verify the required service remains available and the excluded service plan is disabled during Beacon Manufacturing's employee account lifecycle rollout
- Compare updated users and command errors with the approved source roster during Beacon Manufacturing's employee account lifecycle rollout
Explanation
Correct Answer
C:Verify the required service remains available and the excluded service plan is disabled. This acceptance testing step is specific to license service-plan control. The immediate task is to observe a concrete success condition, not rely on a configuration screenshot alone. It responds to the evidence that the assigned subscription contains multiple independently controllable service plans and advances the required outcome to apply service-plan configuration to the correct license assignment.
Incorrect Answers
A:Verify the guest redeems the invitation and sees only the shared resources. This is an acceptance testing step for external guest collaboration, where an approved contractor requires collaboration on selected tenant resources without a regular employee account. The current case instead reports that users need core Microsoft 365 services but one licensed service plan must remain disabled for a cohort. It does not directly demonstrate the required outcome to apply service-plan configuration to the correct license assignment at this decision stage.
B:Confirm members can access the intended group collaboration resources while nonmembers cannot. This is an acceptance testing step for microsoft 365 group workspace collaboration, where a cross-functional team needs shared group conversations and files with self-service collaboration. The current case instead reports that users need core Microsoft 365 services but one licensed service plan must remain disabled for a cohort. It does not directly demonstrate the required outcome to apply service-plan configuration to the correct license assignment at this decision stage.
D:Compare updated users and command errors with the approved source roster. This is an acceptance testing step for bulk user administration with graph powershell, where human resources provides a large validated staff roster requiring repeatable account updates. The current case instead reports that users need core Microsoft 365 services but one licensed service plan must remain disabled for a cohort. It does not directly demonstrate the required outcome to apply service-plan configuration to the correct license assignment at this decision stage.
Question 444
At Mosaic Technology, the security operations team is responsible for a security incident response modernization. Analysts need context on an emerging malicious domain that appears in tenant telemetry. The documented evidence is: threat Intelligence has indicator and actor context relevant to the domain. The required outcome is to interpret threat context to guide the response. The owner requires repeatable validation using a dedicated test identity or dataset. Which configuration or response best meets the specified requirement?
- Select feasible Secure Score improvement actions based on benefit and operational impact during Mosaic Technology's security incident response modernization
- Correlate related Defender XDR event evidence into a chronological investigation during Mosaic Technology's security incident response modernization
- Triage the correlated incident in Microsoft Defender XDR rather than handling each signal in isolation during Mosaic Technology's security incident response modernization
- Use Microsoft Defender Threat Intelligence findings to enrich the investigation and assess the domain's risk during Mosaic Technology's security incident response modernization
Explanation
Correct Answer
D:Use Microsoft Defender Threat Intelligence findings to enrich the investigation and assess the domain's risk. This solution design step is specific to defender threat intelligence indicators. The immediate task is to select the technical control that matches the observed requirement. It responds to the evidence that threat Intelligence has indicator and actor context relevant to the domain and advances the required outcome to interpret threat context to guide the response.
Incorrect Answers
A:Select feasible Secure Score improvement actions based on benefit and operational impact. This is a solution design step for microsoft secure score improvement, where security leaders require a prioritized view of Microsoft 365 posture improvement actions. The current case instead reports that analysts need context on an emerging malicious domain that appears in tenant telemetry. It does not directly demonstrate the required outcome to interpret threat context to guide the response at this decision stage.
B:Correlate related Defender XDR event evidence into a chronological investigation. This is a solution design step for incident evidence timeline, where an incident responder needs to reconstruct the order of an account compromise and device activity. The current case instead reports that analysts need context on an emerging malicious domain that appears in tenant telemetry. It does not directly demonstrate the required outcome to interpret threat context to guide the response at this decision stage.
C:Triage the correlated incident in Microsoft Defender XDR rather than handling each signal in isolation. This is a solution design step for unified defender xdr incident triage, where security receives an incident containing correlated suspicious mail, sign-in, and device events. The current case instead reports that analysts need context on an emerging malicious domain that appears in tenant telemetry. It does not directly demonstrate the required outcome to interpret threat context to guide the response at this decision stage.
Question 445
At Harbor Freight, the data loss prevention team is responsible for a sensitive data control implementation. Users occasionally send external messages containing regulated personal identifiers. The documented evidence is: purview DLP policy scope has no rule for the relevant Exchange Online information type. The required outcome is to detect or block inappropriate external disclosure through mail. The change cannot weaken an unrelated control or expand access to uninvolved users. Which post-change check would most directly establish that the requirement has been met?
- Confirm the rule detects representative external sensitive mail and applies the intended response during Harbor Freight's sensitive data control implementation
- Confirm matching sensitive documents trigger the configured cloud sharing restrictions during Harbor Freight's sensitive data control implementation
- Confirm the incident findings correspond to real rule-matching data movement during Harbor Freight's sensitive data control implementation
- Confirm a test sensitive file movement is audited or blocked as intended while unrelated files are unaffected during Harbor Freight's sensitive data control implementation
Explanation
Correct Answer
A:Confirm the rule detects representative external sensitive mail and applies the intended response. This acceptance testing step is specific to exchange online dlp sensitive email. The immediate task is to observe a concrete success condition, not rely on a configuration screenshot alone. It responds to the evidence that purview DLP policy scope has no rule for the relevant Exchange Online information type and advances the required outcome to detect or block inappropriate external disclosure through mail.
Incorrect Answers
B:Confirm matching sensitive documents trigger the configured cloud sharing restrictions. This is an acceptance testing step for sharepoint and onedrive dlp, where sensitive files in SharePoint and OneDrive can be shared with external recipients. The current case instead reports that users occasionally send external messages containing regulated personal identifiers. It does not directly demonstrate the required outcome to detect or block inappropriate external disclosure through mail at this decision stage.
C:Confirm the incident findings correspond to real rule-matching data movement. This is an acceptance testing step for dlp incident investigation and alert triage, where compliance receives multiple DLP alerts but needs to identify which data movement created them. The current case instead reports that users occasionally send external messages containing regulated personal identifiers. It does not directly demonstrate the required outcome to detect or block inappropriate external disclosure through mail at this decision stage.
D:Confirm a test sensitive file movement is audited or blocked as intended while unrelated files are unaffected. This is an acceptance testing step for endpoint data loss prevention, where users can copy sensitive documents to unmanaged removable storage on managed endpoints. The current case instead reports that users occasionally send external messages containing regulated personal identifiers. It does not directly demonstrate the required outcome to detect or block inappropriate external disclosure through mail at this decision stage.
Question 446
At Orchard Logistics, the authentication services team is responsible for a password recovery improvement program. A new employee cannot register strong authentication methods because no usable method is yet available. The documented evidence is: the onboarding process supports Temporary Access Pass but no pass has been issued. The required outcome is to bootstrap an approved strong authentication method without permanent insecure credentials. The initial change must be small enough to observe before organization-wide adoption. Before changing the tenant, which diagnostic investigation would most directly verify the suspected cause?
- Inspect applicable Conditional Access policies and effective MFA grant controls on admin sign-ins during Orchard Logistics' password recovery improvement program
- Inspect Temporary Access Pass policy eligibility and the user's existing registered methods during Orchard Logistics' password recovery improvement program
- Inspect authentication methods policy targeting and existing passkey or FIDO2 registration during Orchard Logistics' password recovery improvement program
- Review SSPR authentication methods and number-of-methods-required policy during Orchard Logistics' password recovery improvement program
Explanation
Correct Answer
B:Inspect Temporary Access Pass policy eligibility and the user's existing registered methods. This investigation step is specific to temporary access pass bootstrap. The immediate task is to verify the root cause, not implement a broad remedy. It responds to the evidence that the onboarding process supports Temporary Access Pass but no pass has been issued and advances the required outcome to bootstrap an approved strong authentication method without permanent insecure credentials.
Incorrect Answers
A:Inspect applicable Conditional Access policies and effective MFA grant controls on admin sign-ins. This is an investigation step for conditional access mfa policy targeting, where admins need MFA enforced centrally for a privileged access cohort. The current case instead reports that a new employee cannot register strong authentication methods because no usable method is yet available. It does not directly demonstrate the required outcome to bootstrap an approved strong authentication method without permanent insecure credentials at this decision stage.
C:Inspect authentication methods policy targeting and existing passkey or FIDO2 registration. This is an investigation step for passkey and authentication methods policy, where security wants approved phishing-resistant sign-in methods for administrators. The current case instead reports that a new employee cannot register strong authentication methods because no usable method is yet available. It does not directly demonstrate the required outcome to bootstrap an approved strong authentication method without permanent insecure credentials at this decision stage.
D:Review SSPR authentication methods and number-of-methods-required policy. This is an investigation step for sspr verification method requirements, where password resets must require an approved number of identity verification methods. The current case instead reports that a new employee cannot register strong authentication methods because no usable method is yet available. It does not directly demonstrate the required outcome to bootstrap an approved strong authentication method without permanent insecure credentials at this decision stage.
Question 447
At Harbor Freight, the hybrid identity team is responsible for a directory provisioning reliability initiative. On-premises directory users fail synchronization because some identifiers are invalid or duplicated. The documented evidence is: the sync readiness report flags malformed user principal names and duplicate proxy addresses. The required outcome is to repair blocking directory attributes before cloud synchronization. The change cannot weaken an unrelated control or expand access to uninvolved users. Which ongoing operational signal would best reveal recurrence of this particular problem?
- Monitor Entra Connect Sync scheduler health and connector export errors during Harbor Freight's directory provisioning reliability initiative
- Review Entra Connect Health alerts and health-report trends during Harbor Freight's directory provisioning reliability initiative
- Watch synchronization error counts for recurring attribute conflicts during Harbor Freight's directory provisioning reliability initiative
- Review attribute sync conflicts and unexpected overwrites during Harbor Freight's directory provisioning reliability initiative
Explanation
Correct Answer
C:Watch synchronization error counts for recurring attribute conflicts. This ongoing assurance step is specific to idfix directory attribute remediation. The immediate task is to watch for regression in the relevant control or service. It responds to the evidence that the sync readiness report flags malformed user principal names and duplicate proxy addresses and advances the required outcome to repair blocking directory attributes before cloud synchronization.
Incorrect Answers
A:Monitor Entra Connect Sync scheduler health and connector export errors. This is an ongoing assurance step for microsoft entra connect sync topology, where a hybrid organization requires supported on-premises AD DS synchronization features managed by a dedicated sync server. The current case instead reports that on-premises directory users fail synchronization because some identifiers are invalid or duplicated. It does not directly demonstrate the required outcome to repair blocking directory attributes before cloud synchronization at this decision stage.
B:Review Entra Connect Health alerts and health-report trends. This is an ongoing assurance step for entra connect health monitoring, where the hybrid identity team notices authentication and synchronization outages only after end users report problems. The current case instead reports that on-premises directory users fail synchronization because some identifiers are invalid or duplicated. It does not directly demonstrate the required outcome to repair blocking directory attributes before cloud synchronization at this decision stage.
D:Review attribute sync conflicts and unexpected overwrites. This is an ongoing assurance step for source-of-authority for synchronized attributes, where a synchronized employee display name keeps reverting after cloud-side edits. The current case instead reports that on-premises directory users fail synchronization because some identifiers are invalid or duplicated. It does not directly demonstrate the required outcome to repair blocking directory attributes before cloud synchronization at this decision stage.
Question 448
At Elmstone Technology, the workplace administration team is responsible for an employee account lifecycle rollout. Application access must be granted to a controlled group of staff, without a collaboration mailbox. The documented evidence is: existing permission assignments are per user and difficult to review. The required outcome is to manage reusable identity membership for authorization. The owner requires repeatable validation using a dedicated test identity or dataset. Before changing the tenant, which diagnostic investigation would most directly verify the suspected cause?
- Inspect sample roster data and Microsoft Graph PowerShell authentication scopes before automation during Elmstone Technology's employee account lifecycle rollout
- Check the existing group type and whether access controls require a security principal during Elmstone Technology's employee account lifecycle rollout
- Inspect group-based license assignments, license availability, and each user's usage location during Elmstone Technology's employee account lifecycle rollout
- Inspect application role assignments and candidate Microsoft Entra security groups during Elmstone Technology's employee account lifecycle rollout
Explanation
Correct Answer
D:Inspect application role assignments and candidate Microsoft Entra security groups. This investigation step is specific to security group permission targeting. The immediate task is to verify the root cause, not implement a broad remedy. It responds to the evidence that existing permission assignments are per user and difficult to review and advances the requested outcome to manage reusable identity membership for authorization.
Incorrect Answers
A:Inspect sample roster data and Microsoft Graph PowerShell authentication scopes before automation. This is an investigation step for bulk user administration with graph powershell, where human resources provides a large validated staff roster requiring repeatable account updates. This case instead reports that application access must be granted to a controlled group of staff, without a collaboration mailbox. It does not directly demonstrate the required outcome to manage reusable identity membership for authorization at this decision stage.
B:Check the existing group type and whether access controls require a security principal. This is an investigation step for mail-enabled security group, where a compliance committee needs a single email address and a permission-assignable membership. This case instead reports that application access must be granted to a controlled group of staff, without a collaboration mailbox. It does not directly demonstrate the required outcome to manage reusable identity membership for authorization at this decision stage.
C:Inspect group-based license assignments, license availability, and each user's usage location. This is an investigation step for group-based licensing, where hundreds of users need Microsoft 365 service licenses according to department membership. This case instead reports that application access must be granted to a controlled group of staff, without a collaboration mailbox. It does not directly demonstrate the required outcome to manage reusable identity membership for authorization at this decision stage.
Question 449
At Harbor Freight, the security operations team is responsible for an enterprise security posture program. Analysts need context on an emerging malicious domain that appears in tenant telemetry. The documented evidence is: threat Intelligence has indicator and actor context relevant to the domain. The required outcome is to interpret threat context to guide the response. The change cannot weaken an unrelated control or expand access to uninvolved users. Which post-change check would most directly establish that the requirement has been met?
- Confirm the specific indicator is correlated with observed events before applying targeted controls during Harbor Freight's enterprise security posture program
- Confirm the incident's alert relationships and investigation actions are recorded consistently during Harbor Freight's enterprise security posture program
- Confirm the targeted improvement action status changes as configuration is detected during Harbor Freight's enterprise security posture program
- Confirm reconstructed event order is consistent across alert and telemetry timestamps during Harbor Freight's enterprise security posture program
Explanation
Correct Answer
A:Confirm the specific indicator is correlated with observed events before applying targeted controls. This acceptance testing step is specific to defender threat intelligence indicators. The immediate task is to observe a concrete success condition, not rely on a configuration screenshot alone. It responds to the evidence that threat Intelligence has indicator and actor context relevant to the domain and advances the required outcome to interpret threat context to guide the response.
Incorrect Answers
B:Confirm the incident's alert relationships and investigation actions are recorded consistently. This is an acceptance testing step for unified defender xdr incident triage, where security receives an incident containing correlated suspicious mail, sign-in, and device events. The current case instead reports that analysts need context on an emerging malicious domain that appears in tenant telemetry. It does not directly demonstrate the required outcome to interpret threat context to guide the response at this decision stage.
C:Confirm the targeted improvement action status changes as configuration is detected. This is an acceptance testing step for microsoft secure score improvement, where security leaders require a prioritized view of Microsoft 365 posture improvement actions. The current case instead reports that analysts need context on an emerging malicious domain that appears in tenant telemetry. It does not directly demonstrate the required outcome to interpret threat context to guide the response at this decision stage.
D:Confirm reconstructed event order is consistent across alert and telemetry timestamps. This is an acceptance testing step for incident evidence timeline, where an incident responder needs to reconstruct the order of an account compromise and device activity. The current case instead reports that analysts need context on an emerging malicious domain that appears in tenant telemetry. It does not directly demonstrate the required outcome to interpret threat context to guide the response at this decision stage.
Question 450
At Seabright Retail, the cloud application security team is responsible for a cloud service security initiative. A large file-sharing service appears in Cloud Discovery but has not been risk reviewed. The documented evidence is: cloud Discovery displays app usage volume, risk score, and user activity. The required outcome is to assess and govern shadow IT apps based on risk and usage. The project requires audit-ready before-and-after configuration records. Which configuration or response best meets the specified requirement?
- Configure a Defender for Cloud Apps file policy for the specified risky sharing pattern during Seabright Retail's cloud service security initiative
- Classify the risky app as unsanctioned where supported and coordinate controls during Seabright Retail's cloud service security initiative
- Configure the supported Microsoft 365 app connector in Defender for Cloud Apps during Seabright Retail's cloud service security initiative
- Configure or tune Defender for Cloud Apps anomaly detection policies for the supported scenario during Seabright Retail's cloud service security initiative
Explanation
Correct Answer
B:Classify the risky app as unsanctioned where supported and coordinate controls. This solution design step is specific to unsanctioned app risk classification. The immediate task is to select the technical control that matches the observed requirement. It responds to the evidence that cloud Discovery displays app usage volume, risk score, and user activity and advances the requested outcome to assess and govern shadow IT apps based on risk and usage.
Incorrect Answers
A:Configure a Defender for Cloud Apps file policy for the specified risky sharing pattern. This is a solution design step for defender for cloud apps file policies, where security wants alerts when a connected cloud app exposes sensitive files through overly broad sharing. This case instead reports that a large file-sharing service appears in Cloud Discovery but has not been risk reviewed. It does not directly demonstrate the required outcome to assess and govern shadow IT apps based on risk and usage at this decision stage.
C:Configure the supported Microsoft 365 app connector in Defender for Cloud Apps. This is a solution design step for defender for cloud apps app connector, where analysts need Microsoft 365 activity and file visibility through Defender for Cloud Apps. This case instead reports that a large file-sharing service appears in Cloud Discovery but has not been risk reviewed. It does not directly demonstrate the required outcome to assess and govern shadow IT apps based on risk and usage at this decision stage.
D:Configure or tune Defender for Cloud Apps anomaly detection policies for the supported scenario. This is a solution design step for cloud apps anomaly detection policy, where security needs automated detection of unusual cloud application behavior across accounts. This case instead reports that a large file-sharing service appears in Cloud Discovery but has not been risk reviewed. It does not directly demonstrate the required outcome to assess and govern shadow IT apps based on risk and usage at this decision stage.
