SC-100 Certification Practice Question #109

Question

Your network contains an Active Directory Domain Services (AD DS) domain named Domain1.

You have a Microsoft Entra tenant.

Domain1 syncs with the tenant by using Microsoft Entra Connect.

You need to monitor Domain1 for privilege escalation attacks.

What should you use?

Accepted Answer

The scenario is an on-premises AD DS domain (Domain1) synced to Entra via Entra Connect, and the requirement is to *monitor* for privilege escalation *attacks*. Microsoft Defender for Identity installs sensors directly on AD DS domain controllers and is purpose-built to detect identity-based threats including the privilege-escalation phase (e.g., suspicious additions to sensitive groups, Netlogon elevation, certificate-enrollment abuse). Entra ID Protection (A) only evaluates cloud Entra ID identities, Defender for Servers (B) protects server workloads rather than the directory, and PIM (D) is a governance/JIT-access control, not a threat-detection tool. Suggested Answer, the unanimous community vote, and MS Learn all converge on C.

More SC-100 practice questions