What should you do?

Your network contains an on-premises Active Directory domain. The domain contains servers that run Windows Server and have advanced auditing enabled.

The security logs of the servers are collected by using a third-party SIEM solution.

You purchase a Microsoft 365 subscription and plan to deploy Azure Advanced Threat Protection (ATP) by using standalone sensors.

You need to ensure that you can detect when sensitive groups are modified and when malicious services are created.

What should you do?
A . Configure Azure ATP notifications
B . Configure Event Forwarding on the domain controllers
C . Configure auditing in the Office 365 Security & Compliance center
D . Modify the Domain synchronizer candidate settings on the Azure ATP sensors

Answer: B

Explanation:

Reference: https://docs.microsoft.com/en-us/azure-advanced-threat-protection/configure-event-forwarding