Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
Microsoft Certified: Cybersecurity Architect Expert · Microsoft
Step Sequence / Reordering Question
Add and arrange the steps in the correct execution order.
Hotspot Solution:
To protect against the specified external threats in a Microsoft cloud environment based on the Microsoft Cybersecurity Reference Architectures (MCRA), you should include the following recommendations: For an attacker attempting to exfiltrate data to external websites: Microsoft Defender for Cloud Apps: This solution provides comprehensive visibility, control over data travel, and sophisticated analytics to identify and combat cyber threats across all your cloud services1. For an attacker attempting lateral movement across domain-joined computers: Microsoft Defender for Identity: This tool helps detect and investigate advanced threats, compromised identities, and malicious insider actions directed at your organization
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
An attacker attempts to exfiltrate data to external websites: Microsoft Defender for Cloud Apps An attacker attempts lateral movement across domain-joined computers: Microsoft Defender for Identity
https://learn.microsoft.com/en-us/training/modules/case-study-design-solutions-security-best-practices-priorities/3-case-study-answers To prevent a ransomware attacker from copying files outside of the Microsoft 365 tenant, customers can use Microsoft Purview Data Loss Prevention (DLP) policies, which detect, warn, and block risky, inadvertent, or inappropriate sharing of data containing personal data and confidential organization information based on sensitivity labels. This can be supplemented by Microsoft Defender for Cloud Apps, which supports session monitoring as part of Conditional Access App Control. The monitoring applies to the flow of data between users and managed applications and can be used to block transfers of business sensitive content.
Exfiltration of data - Defender for Cloud Apps Data across domains - Defender for Identity Reference: MCRA Slide 67 and https://learn.microsoft.com/en-us/training/modules/design-resiliency-strategy-common-cyberthreats-like-ransomware/1-common-cyberthreats-attack-patterns