SC-100 Certification Practice Question #262

Question

You need to recommend a strategy for securing the litware.com forest. The solution must meet the identity requirements.
What should you include in the recommendation? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:

Accepted Answer

The identity requirements are (1) implement leaked-credential detection in the Azure AD tenant and (2) detect brute-force attacks that directly target AD DS user accounts without locking those accounts out. For Row 1, Azure AD (Entra) Identity Protection is the only listed option that performs leaked-credential and password-spray risk detection in the cloud tenant — Defender for Cloud is resource/workload security and Azure AD Password Protection blocks weak passwords rather than detecting compromise. For Row 2, Microsoft Defender for Identity uses sensors on domain controllers to raise the "Suspected brute-force attack (Kerberos/NTLM/LDAP)" alerts against AD DS accounts and can remediate without locking the account, satisfying the "prevent lockout" constraint; an AD DS account-lockout policy would itself lock accounts (the opposite of the requirement), and Defender for Endpoint is device-level EDR. The two highest-voted threads (JaySapkota 42, awssecuritynewbie 15) align with this pairing; confidence is held at 83 because the single highest-voted comment (PlumpyTumbler 54) chose lockout policy for Box 2 before MDI reasoning prevailed in later discussion.

More SC-100 practice questions