You have a Microsoft 365 E5 subscription that contains a Microsoft SharePoint Online site named Site1.
You need to be notified if a user downloads more than 50 files in one minute from Site1.
Which type of policy should you create in the Microsoft Defender for Cloud Apps portal?
To receive a notification when a user downloads more than 50 files in one minute from a SharePoint Online site, you should create an activity policy in the Microsoft Defender for Cloud Apps portal. Activity policies allow you to monitor and alert on specific actions performed by users, such as file downloads, making it suitable for detecting and responding to this type of behavior.
High download rate You can set your activity policy so that you receive an alert when there has been an unexpected or uncharacteristic level of downloading activity. To configure this sort of policy, under Rate parameters, choose the parameters to trigger the alert. https://learn.microsoft.com/en-us/defender-cloud-apps/user-activity-policies#custom-alerts
The correct answer is B. activity policy. Activity policies in Microsoft Defender for Cloud Apps allow you to detect and respond to risky behavior in your cloud apps. You can use an activity policy to be notified if a user downloads more than 50 files in one minute from Site1.
Custom alerts in Activity policies https://learn.microsoft.com/en-us/defender-cloud-apps/user-activity-policies
B. activity policy
B is correct
B. activity policy
Correct answer: B Activity policy for Mass download by a single user https://learn.microsoft.com/en-us/defender-cloud-apps/policy-template-reference#policy-template-highlights
C. File policy: File policies in Microsoft Defender for Cloud Apps allow you to define rules and conditions related to file activities, such as uploads, downloads, and sharing. You can set up a file policy to monitor and alert on specific file-related actions, like the number of files downloaded in a given time frame. In this case, you want to monitor the download activity from Site1, so a file policy is the appropriate choice.
https://learn.microsoft.com/en-us/defender-cloud-apps/data-protection-policies#policies There is no mention of downloads. Don't know where you got that.
file policy focuses on file attributes (e.g., sensitivity labels, sharing status) and governance actions, not on tracking the frequency of user actions like downloads over time.
Checked MDE portal. This is activity policy
Answer B as others stated
B. activity policy