Exam MS-101 topic 2 question 118 discussion

Option A, creating an alert policy from the Microsoft 365 Defender portal, is a better choice than option D, creating an alert from the SharePoint Online site, because it allows you to centrally manage and monitor all alerts for your Microsoft 365 tenant in one place. By creating an alert policy in the Microsoft 365 Defender portal, you can specify the conditions for the alert, such as which users or groups to monitor, what actions to trigger the alert (such as sharing a file or folder), and how to notify the human resources manager (such as by email or through a mobile app notification). This way, you have greater control and flexibility over the alerting process. Creating an alert directly from the SharePoint Online site may be useful for a one-time or ad hoc alert, but it can be more challenging to manage and monitor multiple alerts across different SharePoint sites and other Microsoft 365 services.

I agree, it's an Alert Policy from the Microsoft 365 Defender portal

Microsoft 365 Defender portal: Go to the Microsoft 365 Defender portal and under Email & collaboration select Policies & rules > Alert policy. Alternatively, you can go directly to https://security.microsoft.com/alertpolicies. Activity the alert is tracking. You create a policy to track an activity or in some cases a few related activities, such a sharing a file with an external user by sharing it, assigning access permissions, or creating an anonymous link. When a user performs the activity defined by the policy, an alert is triggered based on the alert threshold settings.

CREATE AN ALERT POLICY FROM THE MICROSOFT 365 DEFENDER PORTAL