SC-100 Certification Practice Question #226

Question

You have a Microsoft 365 tenant.

You need to recommend a Microsoft 365 Defender solution to enhance security for the tenant. The solution must meet the following requirements:

•	Identify users that are downloading an unusually high number of files from Microsoft SharePoint Online sites and are possibly involved in a data exfiltration attempt.
•	Block Microsoft Teams messages that contain potentially malicious content by using zero-hour auto purge (ZAP).

What should you recommend for each requirement? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Accepted Answer

Both requirements map cleanly to MS Learn. The "unusual high number of file downloads from SharePoint = possible data exfiltration" is the textbook Defender for Cloud Apps anomaly-detection policy ("Unusual multiple file download activities"), since Defender for Cloud Apps is the CASB that baselines per-user cloud-storage activity. Zero-hour auto purge (ZAP) for Teams is exclusively a Defender for Office 365 capability that retroactively detects and quarantines malicious Teams messages. Three independent community comments (10 combined votes) agree on this pairing, and MS Learn documents both features verbatim, so confidence is high; it is slightly below 95 only because the file shows no explicit suggested-answer key.

More SC-100 practice questions