SC-100 Certification Practice Question #138

Question

You have a Microsoft 365 E5 subscription that uses Microsoft Defender XDR and Microsoft Purview.

You need to recommend a data protection solution. The solution must ensure that you can identify users that download atypical amounts of data from Microsoft SharePoint Online.

Which service should you include in the recommendation, and which policy should be configured? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Accepted Answer

The requirement is to identify users who download *atypical amounts* of data from SharePoint Online — a behavioral, baseline-relative signal, not content matching or blocking. Microsoft Defender for Cloud Apps provides UEBA-driven built-in anomaly detection policies, and the "Unusual multiple file download activities" detection flags exactly this behavior against a learned per-user baseline for SharePoint/OneDrive, as confirmed by MS Learn. The two relevant commenters and a third confirmation all select Defender for Cloud Apps + Anomaly detection policy, and no competing pair is offered. DLP, Endpoint DLP, and file policies are eliminated because they enforce on content sensitivity rather than detect unusual activity volume. Confidence is 86 (a confidently resolved HOTSPOT) rather than higher because there is no printed Suggested Answer or "Most Voted" marker and a commenter flags that Microsoft is transitioning anomaly detection logic (June 2025), which could affect the live product even though the exam-key pairing remains Defender for Cloud Apps + Anomaly detection policy.

More SC-100 practice questions