
Explanation:
Statement
Answer
At the Montreal office, if User1 downloads 40 files in 45 seconds, an alert will be created.
No
At the Seattle office, if User2 downloads one file per second for two minutes, an alert will be created.
Yes
At the New York City office, if User1 downloads 40 files in 10 seconds, an alert will be created.
No
The policy is a Microsoft Defender for Cloud Apps activity policy configured for Repeated activity by a single user. The threshold is 30 repeated activities within 1 minute, and the activity type is Download.
Microsoft documents that activity policies can be configured for repeated activity, including a minimum activity count and a timeframe, and that activity type filters are used to match app activities such as downloads.
The decisive filter is the Raw IP address condition: 10.10.0.0/24 OR 194.25.2.0/24. Defender for Cloud Apps supports filtering by raw IP address, meaning activities performed from or by those raw IP addresses. For cloud activity, the relevant source address is the externally visible address reported by the cloud app.
Microsoft warns that internal IP addresses audited by connected cloud apps should not be confused with the internal source-network IPs of user devices, because cloud applications are not exposed to those device internal IPs.
Montreal does not match because its public NAT segment is 190.15.1.0/24, not 10.10.0.0/24 or 194.25.2.0/24.
Seattle does match because its public NAT segment is 194.25.2.0/24, and one download per second for two minutes exceeds 30 downloads in one minute. New York does not match because its public NAT segment is
198.35.3.0/24.