Question 199 of 241
MS-102 Practice Question: Manage security and threats by using Microsoft Defender XDR
An organization uses Microsoft Defender for Cloud Apps to monitor shadow IT. They want to enforce policies that block downloads from risky cloud apps. Which Microsoft Defender XDR component provides this capability?
⚠ Common exam trap
Test-takers frequently confuse Microsoft Defender for Cloud Apps with Microsoft Defender for Office 365, assuming that Office 365's data loss prevention (DLP) covers all cloud apps, but DLP in Office 365 is limited to Microsoft 365 services, not third-party shadow IT apps.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Defender for Cloud Apps
Microsoft Defender for Cloud Apps is the correct component because it is specifically designed to provide visibility into shadow IT and enforce policies on cloud applications. Its 'Governance' actions include blocking downloads from risky apps by integrating with the cloud app's API to prevent data exfiltration, which directly addresses the requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Microsoft Defender for Cloud Apps
Why this is correct
Microsoft Defender for Cloud Apps is a Cloud Access Security Broker (CASB) that discovers sanctioned and unsanctioned cloud apps, assesses risk via the Cloud App Catalog, and enforces real-time session and access policies. It can restrict risky app usage using conditional access app controls, block downloads, or apply DLP checks across thousands of third-party SaaS services — capabilities no workload-specific Defender product can provide.
- ✗
Microsoft Defender for Endpoint
Why it's wrong here
Microsoft Defender for Endpoint is an endpoint detection and response (EDR) solution focused on mitigating malware, fileless attacks, and other threats on physical and virtual devices. While it feeds device signals into Defender for Cloud Apps for advanced risk correlation, it does not itself perform cloud app discovery, monitor cloud app usage, or apply session-level controls to govern employee use of unsanctioned SaaS applications.
- ✗
Microsoft Defender for Identity
Why it's wrong here
Microsoft Defender for Identity is an identity-threat detection product that analyzes on-premises Active Directory traffic and metadata to detect attacks such as kerberoasting, lateral movement, and privilege escalation. It answers the question of who is trying to compromise accounts and privileges, but it has no visibility into cloud app web sessions and no policy-enforcement mechanism to block or restrict how users interact with third-party cloud services.
- ✗
Microsoft Defender for Office 365
Why it's wrong here
Microsoft Defender for Office 365 protects Microsoft 365 workloads — Exchange Online, SharePoint Online, OneDrive, and Teams — against phishing, malware, and unsafe attachments through controls like Safe Attachments, Safe Links, and anti-spam policies. Its protections are intrinsically tied to Microsoft 365 collaboration services and cannot discover or monitor user activity in external cloud apps such as Box, Salesforce, or Google Workspace, which are the target of a CASB solution.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jun 11, 2026
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.