Conditional Access App Control for Real-Time Blocking of Sensitive File Downloads
A security administrator wants to configure Microsoft Defender for Cloud Apps to block downloads of sensitive files from Salesforce to unmanaged devices in real time. Which Defender for Cloud Apps component must be configured?
Quick Answer
The answer is Conditional Access App Control (CAAC), which must be configured in Microsoft Defender for Cloud Apps to block downloads of sensitive files from Salesforce to unmanaged devices in real time. CAAC works by integrating with Azure AD Conditional Access policies and using a reverse proxy architecture to inspect and intervene in user sessions as they happen, allowing it to enforce granular controls like blocking file downloads the moment a user attempts them from an unmanaged device. On the MS-102 exam, this scenario tests your understanding of how Defender for Cloud Apps components differ—specifically, that session policies (powered by CAAC) provide real-time blocking, whereas app discovery or cloud discovery only report on usage. A common trap is confusing CAAC with app connector policies, which apply API-based controls after the fact, not in real time. Remember the memory tip: “CAAC catches it as it happens—reverse proxy, real-time blocking.”
⚠ Common exam trap
It's easy for candidates to confuse App Connectors (API-based governance) with Conditional Access App Control (proxy-based real-time control), assuming both can block downloads in real time, but only the reverse proxy can intercept and block actions during the session.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Conditional Access App Control
Conditional Access App Control (CAAC) is the correct component because it enables real-time session-level monitoring and control of user activities in SaaS apps like Salesforce. By integrating with Microsoft Entra Conditional Access, CAAC can enforce policies to block downloads of sensitive files to unmanaged devices at the moment of access, using reverse proxy architecture to inspect and intervene in the traffic.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Cloud Discovery
Why it's wrong here
Cloud Discovery only analyses traffic logs to catalogue shadow IT usage; it cannot inspect file content or enforce download blocks. It is tempting because it identifies unsanctioned apps, and would be correct for discovering which cloud services staff use, but real-time session control requires Conditional Access App Control.
- ✗
App Connectors
Why it's wrong here
App Connectors use APIs to give visibility and governance over sanctioned apps, but API-based policies act after the fact, not in real time. They are tempting because they connect Salesforce to Defender for Cloud Apps, and would suit retroactive quarantine or alerts, yet blocking live downloads needs Conditional Access App Control.
- ✓
Conditional Access App Control
Why this is correct
Conditional Access App Control proxies sessions through Defender for Cloud Apps, enabling real-time inline enforcement such as blocking downloads to unmanaged devices. Session policies alone cannot block in real time, so this component satisfies the real-time blocking constraint for Salesforce.
- ✗
Activity policies
Why it's wrong here
Activity policies govern user activity and can apply governance actions such as block or protect, but real-time download blocking on unmanaged devices requires a session policy, which proxies the session. Activity policies are correct for detecting and alerting on post-event activity, not inline session control.
Go deeper
Related to this question
Learn chapter
Exchange Mobile Device Policies (OWA)
Key term
Conditional access
Conditional access is a security framework that evaluates signals like user location, device health, and risk level to grant or block access to resources in real time.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
Courseiva writes every MS-102 question from scratch — 712 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on MS-102
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A security administrator wants to configure Microsoft Defender for Cloud Apps so that when a user accesses a sensitive file in a sanctioned cloud app from an unmanaged device, the user is blocked from downloading the file and a block action is logged in real time. Which type of policy should the administrator configure?
hard- ✓ A.Create a session policy with the action 'Block' on the download action for files with a specific sensitivity label
- B.Create a file policy that monitors for sensitive files being accessed from unmanaged devices and generates an alert
- C.Configure an access policy that blocks access to the cloud app from unmanaged devices
- D.Configure an activity policy that monitors download activities from unmanaged devices and triggers automatic remediation
Why A: A session policy in Microsoft Defender for Cloud Apps allows real-time control over user activities within a sanctioned cloud app. By configuring the action 'Block' on the download action for files with a specific sensitivity label, the administrator can block the download when the session is initiated from an unmanaged device, and the block action is logged in real time. This meets the requirement of blocking the download and logging the action simultaneously.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.