You have a Microsoft 365 E5 subscription. You need to configure Microsoft Defender XDR automatic attack disruption to use signals generated by Microsoft Defender for Cloud Apps. Which two actions…

Question

Options

• AEnable the Microsoft 365 connector.
• BAdd a log collector for automatic log upload.
• CTurn on app governance.
• DDeploy Cloud Discovery user enrichment.
• EFrom Information protection, enable file monitoring.

• A
  78% (14)
• B
  6% (1)
• D
  11% (2)
• E
  6% (1)

Explanation

For Microsoft Defender XDR automatic attack disruption to leverage signals from Microsoft Defender for Cloud Apps, two actions are required. First, enabling the Microsoft 365 connector (A) integrates Cloud Apps data into Defender XDR, making its signals available to the attack disruption engine. Second, turning on app governance (C) provides the governance and behavioral analytics layer within Cloud Apps that generates the high-fidelity signals - particularly around OAuth app abuse and anomalous app behavior - that attack disruption acts on. Adding a log collector (B) is for Cloud Discovery and does not feed into attack disruption signals. Cloud Discovery user enrichment (D) and file monitoring (E) are unrelated to the attack disruption signal pipeline.

No community discussion yet for this question.