Exam 70-744 topic 1 question 108 discussion

Actual exam question from Microsoft's 70-744

Question #: 108
Topic #: 1

Your network contains an Active Directory domain.
Microsoft Advanced Threat Analytics (ATA) is deployed to the domain.
A database administrator named DBA1 suspects that her user account was compromised.
Which three events can you identify by using ATA? Each correct answer presents a complete solution.
NOTE: Each correct selection is worth one point.

A. Domain computers into which DBA1 recently signed.
B. Phishing attempts that targeted DBA1.
C. The last time DBA1 experienced a failed logon attempt.
D. Spam messages received by DBA1.
E. Servers that DBA1 recently accessed.

Show Suggested Answer

Suggested Answer: ACE 🗳️
References:
https://github.com/MicrosoftDocs/ATADocs/blob/master/ATADocs/suspicious-activity-guide.md

by Kamikazekiller at Aug. 9, 2020, 3:15 p.m.

Comments

Submit Cancel

SamsOtro

4 years, 5 months ago

Correct; ATA doesn't monitor Exchange, network SMTP traffic, etc. - monitors communications with/events on - DCs.

upvoted 3 times

...

KidCastaldo

4 years, 7 months ago

I can't say 100% correct but I do agree with it. B and D are more email or boundary related than internal to the domain

upvoted 4 times

expert_ms

4 years, 5 months ago

you need to find not the reason, but check whether the user account was used without his knowledge

upvoted 1 times

...

Exam 70-744 All Questions

View all questions & answers for the 70-744 exam

Exam 70-744 topic 1 question 108 discussion

Comments

SamsOtro

KidCastaldo

expert_ms

SY0-701