1
Respond to security incidents
easy
Refer to the exhibit. An admin creates this activity policy in Microsoft Defender for Cloud Apps. What will happen when a user fails to log in from 3 different IP addresses within 10 minutes?
Exhibit
Refer to the exhibit.
```json
// Microsoft Defender for Cloud Apps policy snippet
{
"policyType": "Activity policy",
"severity": "High",
"description": "Detect multiple failed logins from different IPs",
"filters": {
"activity": "Failed login",
"ip": {
"differentCount": 3,
"timeWindow": 10
}
},
"actions": [
{
"type": "Block",
"target": "User"
}
]
}
```