Exam MS-102 topic 1 question 190 discussion

According to this you can in fact create alert policies in both Microsoft Purview Compliance portal AND Microsoft Defender Portal: https://learn.microsoft.com/en-us/purview/alert-policies?view=o365-worldwide However this article is more targeted towards "unusual usage patterns" which is specifically what the question is asking: https://learn.microsoft.com/en-us/defender-cloud-apps/policies-cloud-discovery#detect-unusual-usage-patterns-on-your-network D. the Microsoft 365 Defender Portal

https://www.examtopics.com/discussions/microsoft/view/94443-exam-ms-101-topic-2-question-107-discussion/

I must go with Defender Portal. You can create policy from either Purview or Defender, but the given condition the word "unusual" most suited with Defender.

Answer is D

This microsoft page explain it all (unusual usage patterns): https://learn.microsoft.com/en-us/defender-cloud-apps/policies-cloud-discovery#detect-unusual-usage-patterns-on-your-network

https://learn.microsoft.com/en-us/purview/alert-policies Suspicious email sending patterns detected Generates an alert when someone in your organization has sent suspicious email and is at risk of being restricted from sending email. This is an early warning for behavior that may indicate that the account is compromised, but not severe enough to restrict the user. Although it's rare, an alert generated by this policy may be an anomaly. However, it's a good idea to

D is correct

D for me

With MS's line of thought , it seems that they want you to create the policy in Purview , manage the alerts in Defender.

D https://learn.microsoft.com/en-us/defender-cloud-apps/policies-cloud-discovery#detect-unusual-usage-patterns-on-your-network

D. the Microsoft 365 Defender portal The Microsoft Purview compliance portal, on the other hand, is primarily focused on data discovery, classification, and compliance related to data governance. It is not specifically designed for monitoring and alerting on usage patterns or security incidents within the Microsoft 365 environment. Therefore, for creating a policy to trigger an alert when unusual Microsoft Office 365 usage patterns are detected, you should use the Microsoft 365 Defender portal.

D agree

By all accounts both B & D is equally right. The alerts are functionally the same. Without knowing the purpose for these alerts(compliance or security team focused) we can't pick one over the other. Another really bad question. https://learn.microsoft.com/en-us/purview/alert-policies You can use alert policies and the alert dashboard in the Microsoft Purview compliance portal or the Microsoft 365 Defender portal to create alert policies and then view the alerts generated when users perform activities that match the conditions of an alert policy. There are several default alert policies that help you monitor activities such as assigning admin privileges in Exchange Online, malware attacks, phishing campaigns, and unusual levels of file deletions and external sharing.

Is this not UEBA?

it's the platform specifically designed for advanced threat protection, security, and detecting unusual usage patterns. So, the correct answer is: D. the Microsoft 365 Defender portal

https://learn.microsoft.com/en-us/microsoft-365/compliance/alert-policies?view=o365-worldwide

CORRECT ANSWER IS B