Identity Threat Detection and Response focuses on identity risk, particularly in directory environments such as Active Directory. To evaluate AD objects, relationships, permissions, and risky identity configurations, ITDR needs directory-level data rather than raw packet captures or firewall summaries. Option B (Reduces identity related risks) is correct because LDAP queries are the standard mechanism for collecting structured AD domain information for identity-risk analysis.
Why the other options are incorrect:
A. Prevents Patient Zero Infections: Patient Zero prevention is malware-first prevention. ITDR reduces identity risk by finding credential, privilege, and directory exposures.
C. Prevents connections to Embargoed Countries: Embargoed-country blocking is geo/access policy. ITDR is focused on identity threats, not destination-country filtering.
D. Blocks malicious traffic by dropping packets: Dropping packets is firewall/IPS behavior. ITDR analyzes identities and permissions rather than acting as a packet filter.
Contribute your Thoughts:
Chosen Answer:
This is a voting comment (?). You can switch to a simple comment. It is better to Upvote an existing comment if you don't have anything to add.
Submit