Exam SC-200 topic 3 question 92 discussion

I think answer looks correct. https://learn.microsoft.com/en-us/azure/sentinel/enable-entity-behavior-analytics To sync user entities from on-premises Active Directory, your Azure tenant must be onboarded to Microsoft Defender for Identity (either standalone or as part of Microsoft 365 Defender) and you must have the MDI sensor installed on your Active Directory domain controller

Correct answer. "To sync user entities from on-premises Active Directory, your Azure tenant must be onboarded to Microsoft Defender for Identity (either standalone or as part of Microsoft Defender XDR) and you must have the MDI sensor installed on your Active Directory domain controller"

Microsoft Defender for Identity sensors: These sensors are deployed on AD DS domain controllers to monitor and collect security-related events and activities directly from Active Directory. Defender for Identity (formerly Azure ATP) plays a crucial role in detecting identity-based threats, which is essential for UEBA to analyze user and entity behavior in your organization. The Security Events data source: This data source must be configured in Microsoft Sentinel to collect relevant security event logs from your domain controllers. Security events such as logons, account lockouts, and other authentication-related events are crucial for UEBA to analyze and detect abnormal behaviors.

What data does Defender for Identity collect? Information collected includes: Security logs, such as Windows security events.

configure some data sources to populate Sentinel with data like SECURITY LOGON EVENTS so this statement implies data source for domain controllers Azure AD audit and sign-in logs, and Azure activity logs. This statement implies datasources in Azure

Correct option