Question
For a Microsoft cloud environment, you are designing a security architecture based on the Microsoft Cybersecurity Reference Architectures (MCRA).
You need to protect against the following external threats of an attack chain:
• An attacker attempts to exfiltrate data to external websites.
• An attacker attempts lateral movement across domain-joined computers.
What should you include in the recommendation for each threat? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Explanation
An attacker attempts to exfiltrate data to external websites: Microsoft Defender for Cloud Apps. As a cloud access security broker it discovers and controls the use of cloud apps and websites, and its session and file policies detect and block uploads of sensitive data to unsanctioned external destinations.
An attacker attempts lateral movement across domain-joined computers: Microsoft Defender for Identity. It monitors on-premises Active Directory domain controller signals and detects lateral movement techniques such as pass-the-hash, pass-the-ticket and lateral movement paths between domain-joined computers. Defender for Office 365 protects email and collaboration, not these attack stages.
