SC-200 Certification Practice Question #34

Question

You have a Microsoft 365 E5 subscription that uses Microsoft Defender 365.

You need to ensure that you can investigate threats by using data in the unified audit log of Microsoft Defender for Cloud Apps.

What should you configure first?

Accepted Answer

Investigating threats from the unified audit log of Defender for Cloud Apps requires the audit data to flow into the service, which happens when you connect the Microsoft 365 app connector (historically labeled the Office 365 connector). MS Learn states the product "integrates directly with Microsoft 365's audit logs" through this connector, matching the question's requirement. The official Suggested Answer and a 20-vote community majority both pick C, and the top two Highly Voted comments cite the connect-Office-365 documentation. The dissent that prefers D is a misread: Automatic log upload configures Cloud Discovery (firewall/proxy log parsing for shadow IT), not the unified audit log. The only confidence reduction comes from the dated "Office 365" wording, which the option still represents.

More SC-200 practice questions