SC-200 Certification Practice Question #13

Question

You purchase a Microsoft 365 subscription.
You plan to configure Microsoft Cloud App Security.
You need to create a custom template-based policy that detects connections to Microsoft 365 apps that originate from a botnet network.
What should you use? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:

Accepted Answer

The question asks for a **custom template-based** policy that **detects connections** and can be **filtered** to a botnet IP. MS Learn confirms Botnet is a built-in IP tag and that custom IP-based detections in Defender for Cloud Apps are authored as **Activity policies** with an IP address Tag filter; the built-in Anomaly detection policy "Activity from suspicious IP addresses" exists but is not customizable and exposes no IP-address-tag filter. Multiple top-voted commenters who tested in the MCAS/Defender portal independently confirm that only the Activity policy creation flow surfaces the IP address > Tag > Botnet filter, and that no custom policy appears under Anomaly detection. The minority "Anomaly detection policy" view is technically appealing (UEBA detects botnet C&C) but fails the question's "custom" + "filter based on IP address tag" constraints, so confidence is held at 82% rather than higher to reflect the genuine community split.

More SC-200 practice questions