Exam MS-101 All Questions

View all questions & answers for the MS-101 exam

Exam MS-101 topic 2 question 34 discussion

Actual exam question from Microsoft's MS-101

Question #: 34
Topic #: 2

HOTSPOT -
You have a Microsoft 365 subscription.
You create a Microsoft Defender for Cloud Apps policy named Risk1 based on the Logon from a risky IP address template as shown in the following exhibit.

You have two users named User1 and User2. Each user signs in to Microsoft SharePoint Online from a risky IP address 10 times within 24 hours.
Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.
NOTE: Each correct selection is worth one point.
Hot Area:

Show Suggested Answer

Suggested Answer:

by PersonT at April 3, 2021, 8:41 a.m.

Comments

Submit Cancel

AnoniMouse

Highly Voted 4 years, 1 month ago

I have just verified in my environment. The admin will get only 5 as per the settings in the exhibit (no matter how many users try to sign in), and the user himself will get only one per day, so the correct answer is: 5 emails for the admin 1 notification for the user

upvoted 47 times

...

originalwitness

Highly Voted 4 years, 2 months ago

Admin1 will receive 5 notifications. The user will receiver 1 per day. Can't find a URL, but you can hover over the information icon and it'll tell you "1 notification per day"

upvoted 19 times

scottims

4 years, 1 month ago

Verified end user notification in lab. "The end user is notified when a policy match is detected. A maximum of one notification is sent per day." The wording seems tricky but if it states maximum of 5 notifications then I suspect Microsoft means that as a hard limit and not a max of 5 per user incident.

upvoted 3 times

...

jecampos2

Most Recent 2 years ago

It says, Act on a single activity. It means the same activity is detected within 24 hours a max of 5 times. Admin = 5, User = 1.

upvoted 1 times

...

Shadowcatest

2 years, 2 months ago

Was in exam 31.03.2023

upvoted 5 times

...

StudyBM

2 years, 3 months ago

Admin = 5 User = 1

upvoted 2 times

...

H3adcap

2 years, 10 months ago

Was in Exam today 20 Aug 2022

upvoted 6 times

rrrr5r

2 years, 9 months ago

In Sep 16th 22's exam.

upvoted 5 times

Sanjee31

2 years ago

in exam 28/6/2023

upvoted 1 times

...

TashaGirl

3 years, 3 months ago

It is Daily alert limit per policy, so this policy, no matter how many users will trigger it, will generate 5 emails to Admin 1.

upvoted 2 times

...

VirtualJP

3 years, 7 months ago

I'm thinking 10 and 1

upvoted 1 times

VirtualJP

3 years, 6 months ago

Not sure why I put 10 and 1! But I'm saying now 5 and 1. :-)

upvoted 1 times

Jakub2023

2 years, 1 month ago

Are you sure? ;-)

upvoted 1 times

...

kmsrajan

4 years ago

It is a single activity which means every activity (each activity is considered irrespective of number of users) done by any user. Hence Admin get maximum of 5 email and user1 will get only one notification per day. Admin 1: 5 User1 : 1

upvoted 5 times

...

lucidgreen

4 years ago

I believe it would be a limit of 5 alerts per user, otherwise, you won't get any alerts about other users. And the users will get alerted each time. So 10 and 10?

upvoted 1 times

lucidgreen

4 years ago

Never mind.

upvoted 3 times

...

karthikn

4 years, 1 month ago

Thank you :) These questions were really helped in cleared the exam

upvoted 1 times

...

potpal

4 years, 1 month ago

So answer should be Admin -> 10x = 2users 5x each and User 1 - 1 notification based on note tip

upvoted 2 times

...

Lopsios

4 years, 2 months ago

There are 2 - User1 and User2. Each user signs in to Microsoft SharePoint Online from a risky IP address 10 times within 24 hours: Admin - 10; User 1 - 5;

upvoted 2 times

Lopsios

4 years, 2 months ago

User 1 - 1; Test in Lab:)

upvoted 4 times

...

MSGrady

4 years, 2 months ago

Anyone have a URL to support this?

upvoted 1 times

...

PersonT

4 years, 3 months ago

5;10..

upvoted 2 times

PersonT

4 years, 2 months ago

autocorrect tablet...should be 5 and 1 The end user is notified when a policy match is detected. A maximum of one otifiication is sent per day...

upvoted 12 times

lucidgreen

4 years, 1 month ago

5 per user to the admin? Or just stop at 5 notifications per day? I'm thinking the former makes more sense, but then, that's a lot of notifications in my environment of 70K+ users and their VPN apps to hide their location! Argh! 10 and 1.

upvoted 3 times

...

dzits

4 years, 1 month ago

Correct - Tested and Confirmed. Admin will get 5 notifications within mailbox. User1 will get 1 notification custom message (Custom message is missing from Exam question). This can be tested by creating same Cloud App Security however change Risky to your ISP IP address by going to Manage IP address ranges and add you IP address as Corperate and updated Risky to Corperate.

upvoted 2 times

...