MS-102 Question 287

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose B1

  B. Generate a Cloud Discovery snapshot report. A snapshot report is used to review cloud app usage over a selected period, such as the last 30 days, so you can identify which apps and services were used most.

• Chose D1

  Why Snapshot Reports Are Not the Right Choice A snapshot report is ad-hoc and requires manual uploading of firewall/proxy logs. It only reflects the period covered by the files you upload, not an automatically managed 30-day rolling window. [youtube.com] In contrast, Defender for Endpoint (MDE) integration feeds continuous Cloud Discovery reports from endpoint telemetry, allowing you to analyze usage over periods such as the last 30 days via the Cloud Discovery dashboard and associated exports/reports (executive).

• Chose B2

  ChatGPT o1: Answer: B. Generate a Cloud Discovery snapshot report Explanation: When you integrate Microsoft Defender for Cloud Apps (formerly MCAS) with Defender for Endpoint, you can use Cloud Discovery to see which cloud apps and services are being used on your network. A Cloud Discovery snapshot report pulls usage data over a specified period (for example, the last 30 days) to show which apps are used most and how frequently they’re accessed. A. Monthly security summary report – This is a high‐level Microsoft 365 Defender report and doesn’t provide details on specific app usage in the last 30 days. C. Threat analytics alert notification – This focuses on alerting and threat analytics rather than a list of frequently used cloud apps. D. Cloud Discovery executive report – An executive report provides broader, high‐level findings and risk assessments but is less targeted than a Cloud Discovery snapshot report for identifying the top apps and services.