An engineer has been asked to build a new dashboard after an increase in login...

The required combination must satisfy two independent requirements : restrict the dataset to failed Azure Active Directory authentication activity and represent the origin of those events geographically. Option D provides that combination by selecting the failure-oriented Azure AD sign-in data and using geographic-coordinate information with a Cluster Map .

A geographic cluster visualization is appropriate when individual events contain point locations such as latitude and longitude. Multiple sign-in failures originating from the same geographic area can then be grouped visually, making concentrations outside the expected operating region—here, North America—immediately apparent. This is particularly useful for authentication monitoring because a raw table of IP addresses does not provide the same rapid geographic interpretation.

The search must also distinguish failures from successful authentication. Merely plotting all sign-ins would allow large quantities of legitimate activity to obscure the specific anomalous behavior being investigated. Conversely, choosing an inappropriate geographic visualization for point-coordinate data would not provide the intended presentation.

Study Guide topics: Azure AD authentication data, failed-login filtering, geospatial enrichment, geographic dashboards, Cluster Map visualization, security analytics.