Question
You need to configure Microsoft Cloud App Security to generate alerts and trigger remediation actions in response to external sharing of confidential files.
Which two actions should you perform in the Cloud App Security portal? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.
- A. From Settings, select Information Protection, select Azure Information Protection, and then select Only scan files for Azure Information Protection classification labels and content inspection warnings from this tenant.
- B. Select Investigate files, and then filter App to Office 365.
- C. Select Investigate files, and then select New policy from search.
- D. From Settings, select Information Protection, select Azure Information Protection, and then select Automatically scan new files for Azure Information Protection classification labels and content inspection warnings. Correct
- E. From Settings, select Information Protection, select Files, and then enable file monitoring. Correct
- F. Select Investigate files, and then filter File Type to Document.
Explanation
Cloud App Security (now Defender for Cloud Apps) can only evaluate files and their sensitivity labels after file monitoring is enabled, and it must be set to automatically scan new files for sensitivity (Azure Information Protection) labels so that confidential files are identified. With those two settings in place, file policies can alert on and remediate external sharing of labelled files. Only scanning files from this tenant restricts label detection rather than enabling it, and filtering the Files page by app or file type only changes a view.
