SC-200 Certification Practice Question #114

Question

You have the following environment:

Azure Sentinel -

✑ A Microsoft 365 subscription
✑ Microsoft Defender for Identity
✑ An Azure Active Directory (Azure AD) tenant
You configure Azure Sentinel to collect security logs from all the Active Directory member servers and domain controllers.
You deploy Microsoft Defender for Identity by using standalone sensors.
You need to ensure that you can detect when sensitive groups are modified in Active Directory.
Which two actions should you perform? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.

Accepted Answer

Detecting modifications to sensitive AD groups depends on Account Management → Audit Security Group Management events (4756/4757/4728/4729), which only appear if the domain controllers have the correct Advanced Audit Policy Configuration enabled — that is option A, confirmed by MS Learn. Because Defender for Identity is deployed here as a **standalone sensor** (not the integrated DC sensor), those Windows events don't automatically reach it; they must be delivered via Windows Event Forwarding (or a SIEM feed), which is option D, the exact scenario in the MDI "Configure Windows event forwarding to your standalone sensor" article. B and C are unrelated to AD auditing. The image is only the environment diagram (Azure Sentinel), not a HOTSPOT, so this is a standard choose-two. Community strongly favors AD, but the official Suggested Answer lists only D, so confidence is held below the 90s.

More SC-200 practice questions