Microsoft Certified: Azure Fundamentals (AZ-900) Practice Exam

Which cloud-based security solution helps investigate threats and compromised identities?

1. Azure Disk Encryption

2. Azure Firewall

3. MSIPE - Microsoft Azure Information Protection

4. Azure Advanced Threat Protection (Azure ATP)

The correct answer is: Azure Advanced Threat Protection (Azure ATP)

Azure Advanced Threat Protection (Azure ATP) is specifically designed to help organizations identify, detect, and respond to advanced threats and compromised identities within their IT environment. It utilizes machine learning, behavioral analytics, and user activity monitoring to analyze user behavior and detect anomalies that could indicate a potential security threat. This solution offers capabilities such as monitoring network traffic to identify suspicious activities, investigating potential threats, and providing actionable insights to security teams. It plays a crucial role in safeguarding an organization’s identity and information by proactively identifying breaches and enabling rapid response. The other options serve different purposes within the Azure ecosystem. Azure Disk Encryption focuses on protecting data at rest on Azure virtual machines by encrypting the disks, providing confidentiality but not directly addressing threat investigation. Azure Firewall acts as a managed network security service that protects Azure Virtual Network resources but does not specifically analyze user behavior or identity threats. Microsoft Azure Information Protection (MSIPE) helps classify and protect documents and emails, ensuring sensitive information is adequately safeguarded, but it is not aimed at investigating threats. In summary, Azure Advanced Threat Protection offers the essential functionalities needed to investigate threats and compromised identities, positioning it as the appropriate choice in this context.