Your network contains an Active Directory Domain Services (AD DS) domain. The domain contains servers that run Windows Server as shown in the following table: Server1: Domain controller that has the…

This question tests knowledge of Microsoft Defender for Identity (MDI) deployment architecture, specifically how to capture all AD DS authentication events without relying on port mirroring, and what domain object is required to support the sensors.

Secure Windows Server on-premises and hybrid infrastructures

Question

Your network contains an Active Directory Domain Services (AD DS) domain. The domain contains servers that run Windows Server as shown in the following table:
Server1: Domain controller that has the PDC emulator FSMO role
Server2: Domain controller
Server3: Has the Active Directory Certificate Services role
Server4: Has Microsoft Entra Connect installed
You need to implement Microsoft Defender for Identity. The solution must meet the following requirements: - Ensure that all AD DS authentication events are captured. - Prevent the use of port mirroring. What should you create in the domain, and what is the minimum number of Defender for Identity sensors that you should deploy? To answer, select the appropriate options in the answer area.

Explanation

Approach. To prevent port mirroring, you must deploy the MDI Sensor (lightweight sensor) directly onto each domain controller rather than using an MDI Standalone Sensor (which requires port mirroring of DC traffic). Since all AD DS authentication events are processed by domain controllers, you must deploy sensors on every DC - Server1 (PDC emulator) and Server2 - giving a minimum of 2 sensors. Before deploying, you must create a Group Managed Service Account (gMSA) in the domain; MDI uses this as its Directory Services Account (DSA) to query AD DS, and gMSA is the Microsoft-recommended account type because it eliminates manual password management and reduces attack surface. Server3 (AD CS) and Server4 (Entra Connect) do not process core AD DS authentication events, so they are not required to meet the stated minimum, though sensors there can enhance detection coverage.

Concept tested. Microsoft Defender for Identity deployment: lightweight sensor vs. standalone sensor (port mirroring), the requirement to cover all domain controllers to capture all authentication events, and the use of a Group Managed Service Account (gMSA) as the Directory Services Account for MDI.

Reference. Microsoft Learn - Deploy Microsoft Defender for Identity with Microsoft Entra ID; MDI sensor deployment prerequisites and Directory Services Account configuration

Topics

#Microsoft Defender for Identity#AD DS Security#Security Monitoring#Sensor Deployment

Community Discussion

No community discussion yet for this question.

Full AZ-801 Practice