Manage security and threats by using Microsoft Defender XDR →mediumMultiple Choice

MS-102 Practice Question: Manage security and threats by using Microsoft Defender XDR

Exhibit

Refer to the exhibit.

```json
// Microsoft Defender for Cloud Apps session policy configuration snippet
{
  "policyType": "session",
  "name": "Block Download for Unmanaged Devices",
  "conditions": {
    "clientType": {
      "include": ["browser", "nativeClient"]
    },
    "deviceTag": {
      "include": ["unmanaged"]
    },
    "app": {
      "include": ["SharePoint Online", "OneDrive for Business"]
    }
  },
  "actions": {
    "block": ["download"]
  }
}
```

Refer to the exhibit. What is the effect of this session policy?

⚠ Common exam trap

Many candidates confuse 'block downloads' with 'block all access' or 'block uploads,' leading them to select options B or C instead of recognizing that the policy specifically targets the download action only.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Blocks download of files from SharePoint Online and OneDrive on unmanaged devices

The session policy shown in the exhibit is configured to block downloads from SharePoint Online and OneDrive for unmanaged devices. This is achieved by applying a conditional access policy that targets unmanaged devices and restricts the download action specifically, while still allowing view-only access. The correct answer is D because the policy explicitly blocks the download of files, not uploads or all access.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Allows viewing but blocks downloading files on managed devices
Why it's wrong here
This session policy is scoped to unmanaged devices, not managed ones. On managed or compliant devices, full file access, including download, is allowed because those devices meet security requirements. Therefore, the claim that it blocks downloads on managed devices misstates the device scope and the intended enforcement target.
✗
Blocks all access to SharePoint and OneDrive from unmanaged native clients only
Why it's wrong here
This policy does not block all access to SharePoint and OneDrive; it specifically blocks the download action while leaving view, edit, and upload actions available. Moreover, the session control applies to both web browsers and native clients, so it is not limited to native client traffic. A full-access block would require a different Conditional Access policy that denies sign-in or session entirely.
✗
Blocks upload of files to SharePoint Online and OneDrive from unmanaged devices
Why it's wrong here
The action enforced by this session policy is blocking downloads, not uploads. Uploading files to SharePoint Online and OneDrive remains permitted from unmanaged devices, as the goal is to prevent data persistence on non-compliant hardware while still enabling users to contribute content. Thus, this option reverses the direction of the restriction.
✓
Blocks download of files from SharePoint Online and OneDrive on unmanaged devices
Why this is correct
This session policy is configured for SharePoint Online and OneDrive to block the download action when access comes from an unmanaged device. It allows other actions like viewing, editing, and uploading, so user productivity is maintained while sensitive files cannot be saved locally on non-compliant devices. The restriction is enforced across both browser and native client access methods.

Go deeper

MS-102 Practice Question: Manage security and threats by using Microsoft Defender XDR

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question