Knowledge check

1.

A security engineer at Contoso wants to see all AI agents operating across the organization's Microsoft environment from a single location. Where in Microsoft Defender XDR does this inventory appear?

Assets > Devices

Assets > AI Agents

Threat intelligence > AI threats

Endpoints > Software inventory

2.

Contoso's security team is reviewing a Copilot Studio agent that has access to the company's SharePoint knowledge base, CRM data connector, and can send emails via Graph API. How is the blast radius of this agent best described?

The agent's blast radius is limited to the SharePoint sites it was explicitly configured to access

The scope of SharePoint documents, CRM records, and email capabilities accessible to the agent if its identity is compromised

The number of users who interact with the agent on a daily basis

The Azure subscription resources the agent's managed identity can access

3.

A security engineer is reviewing attack paths for a Microsoft Foundry agent in Microsoft Defender XDR. The attack path shows the agent identity can reach a storage account containing unrestricted access to financial records. What remediation action directly reduces this attack path?

Enable Microsoft Defender for Storage on the storage account

Remove or scope down the agent identity's permissions to the storage account

Add a Conditional Access policy requiring multifactor authentication for the agent identity

Rotate the client secret or certificate used by the agent identity

Check your knowledge

Feedback