Exam MS-101 topic 3 question 28 discussion

Shouldn't this be C. Cloud App Security?

It's C. In the security and compliance you cannot see neither sign-ins, nor increase in per-user activity.

Likely an outdated question - Defender for Cloud Apps by now is accessible via the Security & Compliance portal...

https://security.microsoft.com/cloudapps/ Access from Microsoft Defender portal - Cloud apps - Activity Log - You will see Activity/User/App/IP address/Location/Device/Date

CAS provides for sign in location as well as apps used logging mechanism

I have just tested the CAS and S&C portals. In terms of administrative effort, the Cloud App Security (now called Microsoft Defender for Cloud Apps) portal definitely is by far the quickest and easiest to use. When selecting a user, I was immediately shown all activity specified in this question (in particular, increases in user activity which was my concern) which can be exported. The information shown within the Security and Compliance logs requires a little bit more effort to locate, and although this can be exported it requires more investigation. The answer here is C - Cloud App Security (Microsoft Defender for Cloud Apps).

I have just tested the CAS and S&C portals. In terms of administrative effort, the Cloud App Security (now called Microsoft Defender for Cloud Apps) portal definitely is by far the quickest and easiest to use. When selecting a user, I was immediately shown all activity specified in this question (in particular, increases in user activity which was my concern) which can be exported. The information shown within the Security and Compliance logs requires a little bit more effort to locate, and although this can be exported it requires more investigation. The answer here is C - Cloud App Security (Microsoft Defender for Cloud Apps).

minimize administrative effort = B

C A Sec

https://docs.microsoft.com/en-us/microsoft-365/compliance/search-the-audit-log-in-security-and-compliance?view=o365-worldwide#audited-activities above link shows the list of activities. Answer is B

Least administrative effort = B https://docs.microsoft.com/en-us/microsoft-365/compliance/search-the-audit-log-in-security-and-compliance?view=o365-worldwide

I think the key here is - "..and increases in activity during the past month". Like a graph, statistics, trends - for this, SCC would be optimal.

B is correct!

The question states minimising administrative effort, which would mean simply opening up S&C and checking the logs. Having to configure CAS is not something that takes minimal effort. Nor is it readily available. That is why I think the answer given is correct. Digg

The activity log in Cloud App Security (Investigate > Activity Log) provides filtering for logins (successfull, failed), user and date range. It super easy to click through. Don't know about similiar functions in Security & Compliance center.

Perhaps the key is "the solution must minimize administrative effort". You can search all those things at Security & Compliance center and at Cloud App Security, but the second one needs configuration (connect CAS to Microsoft cloud apps) . From Security and compliance you can search for specific activities and appears the IP address of the device. https://docs.microsoft.com/en-us/microsoft-365/compliance/search-the-audit-log-in-security-and-compliance?view=o365-worldwide If this is a correct assumption, it would be B, as requires less effort.

B. Security & Compliance