Question
You need to receive a security alert when a user attempts to sign in from a location that was never used by the other users in your organization to sign in.
Which anomaly detection policy should you use?
- A. Impossible travel
- B. Activity from anonymous IP addresses
- C. Activity from infrequent country Correct
- D. Malware detection
Explanation
The Activity from infrequent country policy in Microsoft Defender for Cloud Apps alerts on activity from a location that was not recently or never visited by the user or by any user in the organization. Impossible travel looks at two sign-ins from distant locations within a time too short to travel between them. Activity from anonymous IP addresses flags proxy or anonymizer IPs, and Malware detection scans files in cloud storage, so neither is about rare locations.
