- A
Create a session policy with the action 'Block' on the download action for files with a specific sensitivity label
Correct. Session policies can inspect and control user actions in real time through the reverse proxy, including blocking downloads based on device context.
- B
Create a file policy that monitors for sensitive files being accessed from unmanaged devices and generates an alert
Why wrong: Incorrect. File policies work on static files and can only generate alerts or apply governance actions, not block real-time downloads.
- C
Configure an access policy that blocks access to the cloud app from unmanaged devices
Why wrong: Incorrect. Access policies control sign-in, not in-session actions. The requirement is to allow access but block download.
- D
Configure an activity policy that monitors download activities from unmanaged devices and triggers automatic remediation
Why wrong: Incorrect. Activity policies are reactive and can trigger automated actions, but they cannot block the action in real time before it completes.
MS-102 Practice Question: Manage security and threats by using Microsoft Defender XDR
This MS-102 practice question tests your understanding of manage security and threats by using microsoft defender xdr. This is a configuration task: choose the command set that satisfies every stated requirement. Small differences — like 'secret' vs 'password' or 'transport input ssh' vs 'all' — change whether the answer is correct. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A security administrator wants to configure Microsoft Defender for Cloud Apps so that when a user accesses a sensitive file in a sanctioned cloud app from an unmanaged device, the user is blocked from downloading the file and a block action is logged in real time. Which type of policy should the administrator configure?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
Create a session policy with the action 'Block' on the download action for files with a specific sensitivity label
A session policy in Microsoft Defender for Cloud Apps allows real-time control over user activities within a sanctioned cloud app. By configuring the action 'Block' on the download action for files with a specific sensitivity label, the administrator can block the download when the session is initiated from an unmanaged device, and the block action is logged in real time. This meets the requirement of blocking the download and logging the action simultaneously.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create a session policy with the action 'Block' on the download action for files with a specific sensitivity label
Why this is correct
Correct. Session policies can inspect and control user actions in real time through the reverse proxy, including blocking downloads based on device context.
Related concept
Read the scenario before looking for a memorised answer.
- ✗
Create a file policy that monitors for sensitive files being accessed from unmanaged devices and generates an alert
Why it's wrong here
Incorrect. File policies work on static files and can only generate alerts or apply governance actions, not block real-time downloads.
- ✗
Configure an access policy that blocks access to the cloud app from unmanaged devices
Why it's wrong here
Incorrect. Access policies control sign-in, not in-session actions. The requirement is to allow access but block download.
- ✗
Configure an activity policy that monitors download activities from unmanaged devices and triggers automatic remediation
Why it's wrong here
Incorrect. Activity policies are reactive and can trigger automated actions, but they cannot block the action in real time before it completes.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates confuse session policies with access policies or file policies, mistakenly thinking that blocking access to the entire app (Option C) or monitoring after the fact (Option B) achieves the same real-time blocking of a specific download action, when only a session policy provides the required granular, in-session control.
Detailed technical explanation
How to think about this question
Session policies leverage reverse proxy technology to intercept and inspect user traffic in real time, allowing granular control over actions like download, copy, or print based on conditions such as device state (managed/unmanaged) and file sensitivity labels (via Microsoft Purview Information Protection). The block action is enforced at the HTTP request level, and the event is immediately recorded in the Defender for Cloud Apps activity log, enabling real-time auditing. In a real-world scenario, this is critical for preventing data exfiltration from unmanaged BYOD devices while still allowing read-only access to sensitive documents.
KKey Concepts to Remember
- Read the scenario before looking for a memorised answer.
- Find the constraint that changes the correct option.
- Eliminate answers that are true in general but not in this case.
TExam Day Tips
- Watch for words such as best, first, most likely and least administrative effort.
- Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A company's IT admin needs to give a contractor read-only access to production logs without sharing account credentials. Using role-based access control (RBAC) and temporary scoped permissions — not a permanent shared password — is the correct pattern. Questions like this test whether you can apply least-privilege access across cloud identity services.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
- →
Manage security and threats by using Microsoft Defender XDR — study guide chapter
Learn the concepts, then practise the questions
- →
Manage security and threats by using Microsoft Defender XDR practice questions
Targeted practice on this topic area only
- →
All MS-102 questions
975 questions across all exam domains
- →
Microsoft 365 Administrator MS-102 study guide
Full concept coverage aligned to exam objectives
- →
MS-102 practice test guide
How to use practice tests most effectively before exam day
Related practice questions
Related MS-102 practice-question pages
Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.
Deploy and manage a Microsoft 365 tenant practice questions
Practise MS-102 questions linked to Deploy and manage a Microsoft 365 tenant.
Implement and manage Microsoft Entra identity and access practice questions
Practise MS-102 questions linked to Implement and manage Microsoft Entra identity and access.
Manage security and threats by using Microsoft Defender XDR practice questions
Practise MS-102 questions linked to Manage security and threats by using Microsoft Defender XDR.
Manage compliance by using Microsoft Purview practice questions
Practise MS-102 questions linked to Manage compliance by using Microsoft Purview.
Manage users, groups, licensing, and support practice questions
Practise MS-102 questions linked to Manage users, groups, licensing, and support.
Implement and manage identity and access in Microsoft Entra ID practice questions
Practise MS-102 questions linked to Implement and manage identity and access in Microsoft Entra ID.
MS-102 fundamentals practice questions
Practise MS-102 questions linked to MS-102 fundamentals.
MS-102 scenario practice questions
Practise MS-102 questions linked to MS-102 scenario.
MS-102 troubleshooting practice questions
Practise MS-102 questions linked to MS-102 troubleshooting.
Practice this exam
Start a free MS-102 practice session
Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.
FAQ
Questions learners often ask
What does this MS-102 question test?
Manage security and threats by using Microsoft Defender XDR — This question tests Manage security and threats by using Microsoft Defender XDR — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Create a session policy with the action 'Block' on the download action for files with a specific sensitivity label — A session policy in Microsoft Defender for Cloud Apps allows real-time control over user activities within a sanctioned cloud app. By configuring the action 'Block' on the download action for files with a specific sensitivity label, the administrator can block the download when the session is initiated from an unmanaged device, and the block action is logged in real time. This meets the requirement of blocking the download and logging the action simultaneously.
What should I do if I get this MS-102 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jun 11, 2026
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.