SC-100 Certification Practice Question #103

Question

Your on-premises network contains an Active Directory Domain Services (AD DS) domain and a hybrid deployment between a Microsoft Exchange Server 2019 organization and an Exchange Online tenant. The AD DS domain contains a group named Group1. Group1 is a member of the Organization Management role group for the Exchange deployment.

You have a Microsoft 365 E5 subscription that uses Microsoft Defender.

You have an Azure subscription that uses Microsoft Sentinel.

You need to recommend a solution to ensure that Group1 is marked as a sensitive group and that any changes made to Group1 raises an alert in Microsoft Sentinel. The solution must minimize administrative effort.

What should you include in the recommendation?

Accepted Answer

Group1 is an on-premises AD DS group (member of the Exchange Organization Management role group) that is synchronized to the cloud through the hybrid Exchange deployment. Microsoft Defender for Identity is the only listed solution that monitors on-premises Active Directory directly: it automatically tags privileged/Exchange groups as **Sensitive** entities and raises the "Suspicious additions to sensitive groups" alert on changes. Because MDI is fully integrated with Microsoft Defender XDR, those alerts can be ingested into Microsoft Sentinel via the Defender XDR connector with minimal administrative effort — satisfying both the "mark as sensitive" and "alert in Sentinel" requirements. The official Suggested Answer, a unanimous Most Voted (7), and the highest-voted reasoned comment all converge on A.

More SC-100 practice questions