Review the exhibit.
A security analyst needs to create a report to view the top five categories of unsanctioned
applications accessed in the last 90 days. Referring to the exhibit, what are two data collections in
Advanced Analytics that would be used to create this report? (Choose two.)
A security analyst needs to create a report to view the top five categories of unsanctioned
applications accessed in the last 90 days. Referring to the exhibit, what are two data collections in
Advanced Analytics that would be used to create this report? (Choose two.)Yeah, it should be B and C here. Application Events gives you actions taken within cloud apps, and Page Events logs each time users hit a web app, which is perfect for usage visibility. D (Network Events) is tempting but more about raw traffic than application context, so not the best fit for app category reporting. Pretty sure this matches the exam style, but let me know if I missed something!
Feels like B and D could work here. Application Events logs what users actually do with the apps, and Network Events should capture all the underlying app connections too. Both seem relevant if you want to catch unsanctioned app categories, at least from a network visibility perspective. Open to pushback though if C is more important for category breakdowns!