MS-102 Practice Question: Manage security and threats by using Microsoft Defender XDR
A security administrator wants to block users from uploading files to personal cloud storage apps (e.g., Dropbox) from managed Windows devices, while allowing access from compliant mobile devices. Which Microsoft 365 Defender feature should be used?
⚠ Common exam trap
Many candidates confuse host-level ASR rules (Option A) with cloud-level session policies, failing to recognize that ASR rules cannot enforce conditional access based on device compliance or control uploads to specific cloud apps.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Defender for Cloud Apps session policy
Microsoft Defender for Cloud Apps session policies use reverse proxy architecture to monitor and control user activities in real time. By configuring a session policy with the 'Block' action for the 'Upload file' activity on managed Windows devices, the administrator can prevent file uploads to personal cloud storage apps like Dropbox. Conditional Access App Control enforces this policy based on device compliance, allowing compliant mobile devices to bypass the block.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Defender for Endpoint Attack Surface Reduction rules
Why it's wrong here
Attack Surface Reduction rules are device-centric policies managed by Microsoft Defender for Endpoint that target executable processes, scripts, and malicious behaviors on Windows endpoints. They cannot intercept or control a user's actions within a third-party SaaS application such as Dropbox, Box, or Google Drive. Because they have no visibility into actual uploaded file content or the streaming HTTP session, they are ineligible for a granular block-on-upload policy based on device compliance.
- ✓
Microsoft Defender for Cloud Apps session policy
Why this is correct
Microsoft Defender for Cloud Apps session policies operate through a reverse proxy in conjunction with Azure AD Conditional Access, allowing real-time inspection of a user's SaaS app session. The policy engine can enforce granular actions such as blocking a file upload, download, or print after evaluating device compliance and file attributes. This makes it the correct mechanism to stop users from uploading files to personal cloud storage apps while still allowing compliant access elsewhere.
- ✗
Microsoft Defender for Office 365 Safe Attachments
Why it's wrong here
Safe Attachments in Microsoft Defender for Office 365 is an email security feature that sandboxing unknown attachments and malicious links in Exchange Online messages. Its detonation chamber and verdict logic operate solely on mail transport, not on active HTTP sessions to external web applications. Any file uploaded by a user in a browser session bypasses Safe Attachments entirely, making it irrelevant to controlling personal cloud storage uploads.
- ✗
Microsoft Defender for Identity
Why it's wrong here
Defender for Identity is an on-premises identity security tool that analyzes Active Directory signals, Kerberos traffic, and domain-joined endpoint behavior to detect lateral movement, privilege escalation, and credential compromise. It has no native capability to inspect or broker sessions between a user's browser and Shadow IT or personal SaaS apps. Its scope is the identity plane—not the data plane—of cloud storage file transactions.
Go deeper
Related to this question
Learn chapter
Microsoft 365 Tenant Setup
Key term
Policy
A policy is a set of rules or guidelines that defines how an organization manages, secures, and operates its IT systems and services.
Key term
Device compliance
Device compliance is the process of ensuring that a device meets an organization's security and configuration policies before it can access network resources.
About these practice questions
One of 241 original MS-102 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.