HOTSPOT For a Microsoft cloud environment, you are designing a security architecture based on the Microsoft Cybersecurity Reference Architectures (MCRA). You need to protect against the following external threats of an attack chain: • An attacker attempts to exfiltrate data to external websites. • An attacker attempts lateral movement across domain-joined computers. What should you include in the recommendation for each threat? To answer, select the appropriate options in the answer area.
Defender for Cloud Apps handles monitoring and blocking exfiltration attempts, so I'd pick that for the first threat. For lateral movement, Defender for Identity fits since it picks up suspicious activity in AD like pass-the-hash. Pretty sure this lines up with MCRA, correct me if I'm off.
Cloud Apps for exfiltration, Defender for Identity for lateral movement. Cloud Apps works as a CASB to spot and block suspicious data leaving to outside sites. Defender for Identity is all about catching attacker tricks in AD, like pass-the-hash. I remember seeing similar logic in exam reports but not 100% sure, anyone disagree?
