AZ-500 Secure identity and access Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Conditional Access for Cloud Apps (session control)

  Why this is correct

  Microsoft Entra Conditional Access for Cloud Apps (session control) is an identity-driven, real-time enforcement point that uses a reverse proxy to monitor and restrict user actions inside sanctioned cloud apps. It applies policies at the session layer, allowing you to block download, upload, cut/copy/paste, or print based on user, device, or risk signals—beyond mere sign-in conditions. This is the correct answer because it directly satisfies the requirement to monitor and control behavior in real time within a cloud app session, not just gate initial access.

• ✗

  Information Protection (DLP)

  Why it's wrong here

  Information Protection (DLP) is a data-centric technology that inspects content in transit or at rest, identifies sensitive information, and applies protection actions like encryption, classification, or blocking of data loss. While it can integrate with apps to prevent leakage of credit card numbers or PII, it does not monitor or control the overall behavior of a user session. DLP is fundamentally about safeguarding data, not managing access or enforcing session-based behavioral constraints, which is why it is the wrong choice here.

• ✗

  Cloud Discovery

  Why it's wrong here

  Cloud Discovery is an analytics feature of Microsoft Defender for Cloud Apps that ingests traffic logs (e.g., from proxies or endpoints) to identify shadow IT, unsanctioned cloud apps, and their risk scores. It provides visibility into which apps are being used and by whom, but it does not actively intercept sessions or enforce real-time controls on user actions. Cloud Discovery answers "what's running in my environment?" not "what can the user do right now?", making it insufficient for behavioral control in a specific session.

• ✗

  Application Proxy

  Why it's wrong here

  Microsoft Entra Application Proxy (App Proxy) is a network-level reverse proxy that publishes on-premises web applications to external users, giving them remote access with Microsoft Entra ID multi-factor authentication and single sign-on. It operates at the application publishing and authentication layer, not at the session control layer, so it does not inspect or manipulate in-session user actions like downloads or uploads. App Proxy solves the access problem for legacy apps, but it lacks the behavioral monitoring and control capabilities described in the question.

Go deeper

Related to this question