A public hospital district IT team sees a phishing wave hitting permitting staff and wants broader context than a single mailbox alert. Which concept should guide them?
Select an answer to reveal the explanation.
Short Explanation
One clerk's bad email is a smoke detector; threat intelligence is the weather radar for the whole fire season. Pair the local alert with intel about the wider campaign so you see more than one mailbox's worth of the story. Checking only secure score recommendations and compliance reports, exposure scores and secure configuration findings, or insider risk signals and retention policy matches alone won't give you that bigger picture.
Full Explanation
Threat intelligence supplies campaign, actor, and pattern context beyond a single mailbox alert, while protection alerts show what hit the municipal tenant. Guiding the public hospital district IT team to use threat intelligence signals together with protection alerts yields a clearer view of a phishing wave against permitting staff—scope, indicators, and prioritization—rather than treating each clerk report as an isolated oddity. That combined lens is the fundamentals security concept the scenario asks for.
Using secure score recommendations together with compliance reports to review the campaign fails because secure score and compliance reports describe security posture and compliance hygiene, not the active phishing campaign's actors, indicators, and scope. Using exposure scores together with secure configuration findings to prioritize the campaign fails because those signals prioritize device and configuration exposure for hardening, not the phishing themes, URLs, and sender patterns hitting permitting staff. Using insider risk signals together with retention policy matches to profile the campaign fails because insider risk focuses on internal user risk and retention matches focus on data governance, neither of which supplies the external campaign-level context the team is asking for.
Exam caveat: AB-900 wants describe-level understanding of why intelligence-informed protection matters, not writing full SOC playbooks or configuring every Defender portal workbook. Do not confuse exposure-score and secure-configuration findings tasks with email threat campaigns. Municipal permitting phishing still belongs under threat protection concepts.
Operational check: Open the active phishing alerts for permitting staff, enrich with available threat-intelligence context (campaign themes, URLs, sender patterns), prioritize response for affected mailboxes, and keep Defender protections enabled. Verify clerks report suspicious mail through the supported channel and that IT correlates reports with tenant alerts rather than disabling scanning.
Prefer to study offline? Printable PDF study book + test engine ($7.50, unofficial). These questions stay free here.