You have a Microsoft 365 subscription and Microsoft 365 E5 licenses assigned to your users. You have installed Microsoft Defender for Identity sensors on a domain controller. You validate the installation and notice that the service “Azure Advanced Threat Protection sensor” is not running. You need to investigate why. Where should you look?

Answer options:

A.Microsoft Defender for Identity portal – Reports.
B.On the domain controller where the sensor is installed – Event logs – Application events.
C.Review the "Microsoft.Tri.sensor-Errors.log" file under "%programfiles%\Azure Advanced Threat Protection sensor\Version X\Logs”.
D.Cloud App Security – Activity log

Correct Answer: C 
After you have installed and configured the Microsoft Defender for Identity sensors on a domain controller, you can view the error output in the "Microsoft.Tri.sensor-Errors.log" file. This log contains only the issues and errors detected by the Defender for Identity sensors.
Option A is incorrect.The Microsoft Defender for Identity Reports provides you with system and entity status information, not detailed information regarding the sensor installation.
Option B is incorrect. The application events on the domain controller will not display detailed information about Microsoft Defender for identity sensor error.
Option D is incorrect. Cloud App Security – Activity log gives you security related events and alerts in your tenant.
Reference: 
To know more about Defender for Identity installation, please refer to the link below: 

https://docs.microsoft.com/en-us/defender-for-identity/install-step5