Microsoft Security Operations AnalystMitigate threats using Microsoft Defender XDRHard
A global organization uses Microsoft 365, and its security team needs to implement data loss prevention (DLP) for sensitive financial data shared via Microsoft Teams and SharePoint Online. The DLP solution must automatically detect and protect documents containing specific keywords and patterns (e.g., 'Confidential Financial Report' and credit card numbers) before they are shared externally. Which Microsoft 365 Defender component is primarily responsible for configuring and enforcing these DLP policies for cloud services like Teams and SharePoint?
- AMicrosoft Defender for Endpoint
- BMicrosoft Defender for Identity
- CMicrosoft Defender for Cloud Apps
- DMicrosoft Defender for Office 365
Show answer & explanationAnswer & explanation
Correct answer: C. Microsoft Defender for Cloud Apps
While Microsoft Purview (Compliance Portal) is where DLP policies are *created*, Microsoft Defender for Cloud Apps (MDCAS) is the component that *enforces* these DLP policies across cloud applications like SharePoint, Teams, and OneDrive, providing real-time protection against data exfiltration.
Why the other options are wrong
- A. Defender for Endpoint protects devices, not cloud services like Teams or SharePoint.
- B. Defender for Identity protects against identity-based threats, not data leakage in cloud apps.
- D. Defender for Office 365 primarily protects email and collaboration tools from threats like phishing and malware, but MDCAS provides the broader DLP enforcement across cloud apps.
MDCAS DLP Enforcement
Microsoft Defender for Cloud Apps (MDCAS) enforces Data Loss Prevention (DLP) policies across connected cloud applications, preventing sensitive data exfiltration.
- Integrates with Microsoft Purview DLP policies.
- Provides real-time protection for data in transit and at rest.
- Covers apps like SharePoint, Teams, OneDrive, and third-party cloud apps.
Memory trick: For DLP in 'Cloud Apps', you need 'MDCAS' to guard the gates.