Question
You purchase a Microsoft 365 subscription.
You plan to configure Microsoft Cloud App Security.
You need to create a custom template-based policy that detects connections to Microsoft 365 apps that originate from a botnet network.
What should you use? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Explanation
For Policy template type, choose Activity policy: activity policies evaluate activities from connected apps such as Microsoft 365 against filters you define, and the policy templates for risky IP addresses are activity policies. Access policies require Conditional Access App Control session routing, and anomaly detection policies are built-in behavioral detections that you cannot filter by a custom condition.
For Filter based on, choose IP address tag: Defender for Cloud Apps applies the built-in Botnet tag from Microsoft threat intelligence to IP addresses, so filtering on the IP address tag Botnet catches these connections. Source and user agent string do not identify botnet origin.
