MS-102 Practice Question: Manage security and threats by using Microsoft Defender XDR
A security administrator is configuring Microsoft Defender for Cloud Apps to protect against data exfiltration from SaaS apps. The administrator wants to create a policy that alerts when a user attempts to download more than 50 files from SharePoint Online within 5 minutes. Which two components must be configured to achieve this? (Choose two.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Activity policy
The correct answers are C (Activity policy) and E (App connector for SharePoint Online). An activity policy is needed to define the threshold (50 files in 5 minutes) and trigger an alert when exceeded. The app connector for SharePoint Online must be enabled to allow Defender for Cloud Apps to monitor SharePoint activity. Option A (File policy) is incorrect because file policies govern file sharing and collaboration, not download counts. Option B (Session policy) is used for real-time session control, not alerting on activity counts. Option D (Conditional Access App Control) is used to enforce access policies, not for monitoring specific activities.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
File policy
Why it's wrong here
File policies govern sensitivity labels, external sharing and malware scanning on files already in SharePoint Online; they cannot count downloads within a rolling five-minute window. It is tempting because file policies are the Defender for Cloud Apps feature for SharePoint data protection, and would be correct for alerting on files shared with anonymous external users.
- ✗
Session policy
Why it's wrong here
Session policies apply real-time controls such as block download during a proxied session; they do not evaluate aggregate activity counts over a time window. It is tempting because session policies address exfiltration from SharePoint Online, and would be correct when the requirement is to block or protect downloads rather than raise an alert after 50 files.
- ✓
Activity policy
Why this is correct
An activity policy in Microsoft Defender for Cloud Apps evaluates user activities against repeat-activity and threshold criteria, such as more than 50 downloads within 5 minutes. It satisfies the stem's alerting requirement by triggering on the defined SharePoint Online download pattern.
- ✗
Conditional Access App Control
Why it's wrong here
Conditional Access App Control proxies user sessions to block downloads in real time, but it enforces access controls rather than generating threshold alerts on activity volume. It is tempting because it directly prevents exfiltration from SaaS apps, and would be correct when the requirement is to block downloads outright for unmanaged devices.
- ✓
App connector for SharePoint Online
Why this is correct
The app connector for SharePoint Online links Microsoft Defender for Cloud Apps to the tenant's SharePoint workload via APIs, supplying the activity data policies evaluate. It satisfies the stem's requirement by enabling visibility of file download events needed for the threshold alert.
Go deeper
Related to this question
Learn chapter
Communication Compliance Policies
Key term
SharePoint Online
SharePoint Online is a cloud-based collaboration platform from Microsoft that lets teams create, store, organize, and share content securely from anywhere.
Key term
Conditional access
Conditional access is a security framework that evaluates signals like user location, device health, and risk level to grant or block access to resources in real time.
About these practice questions
Courseiva writes every MS-102 question from scratch — 712 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.