Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
Microsoft Certified: Security Operations Analyst Associate · Microsoft
Hot Area / Sentence Completion
Select the appropriate option to complete the statement. Click Check Answer below to see the marked solution.
Hotspot Solution:
Now the key is in the question's sentence: "detects connections to Microsoft 365 apps that originate from a botnet network" Here, "connections to apps" can be interpreted as already authenticated activity, such as: Uploading/downloading in SharePoint Reading or sending emails in Exchange Interacting with files in OneDrive This would not be captured by Access Policy, but rather by Activity Policy, since the login has already been completed, and the focus is on actions coming from a malicious IP ("botnet" tag). ✅ And regarding the filter: IP address tag This is still correct — it is the best way to detect malicious IPs automatically. 🎯 Therefore, the system's response is technically correct in this context: Policy template type: ✅ Activity policy Filter based on: ✅ IP address tag
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
Now the key is in the question's sentence: "detects connections to Microsoft 365 apps that originate from a botnet network" Here, "connections to apps" can be interpreted as already authenticated activity, such as: Uploading/downloading in SharePoint Reading or sending emails in Exchange Interacting with files in OneDrive This would not be captured by Access Policy, but rather by Activity Policy, since the login has already been completed, and the focus is on actions coming from a malicious IP ("botnet" tag). ✅ And regarding the filter: IP address tag This is still correct — it is the best way to detect malicious IPs automatically. 🎯 Therefore, the system's response is technically correct in this context: Policy template type: ✅ Activity policy Filter based on: ✅ IP address tag
Anomaly detection policy and Ip address Tag
Policy template type: Activity Policy Filter based on: IP address tag