MS-102 Practice Question: Manage security and threats by using Microsoft Defender XDR
You are a security administrator. You need to configure Microsoft Defender for Cloud Apps to detect anomalous user activities such as impossible travel. Which feature should you enable?
⚠ Common exam trap
Candidates often confuse Cloud Discovery (which discovers cloud apps) with Anomaly Detection policies (which detect user behavior anomalies), leading them to select Cloud Discovery for impossible travel detection.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Anomaly Detection policies
Anomaly Detection policies in Microsoft Defender for Cloud Apps are specifically designed to identify user behavior anomalies, such as impossible travel (a user logging in from two geographically distant locations within an impossible timeframe). These policies leverage machine learning and user entity behavior analytics (UEBA) to establish a baseline and flag deviations, making them the correct feature for detecting impossible travel.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
App Discovery
Why it's wrong here
App Discovery in Microsoft Defender for Cloud Apps is specifically designed to identify shadow IT by analyzing traffic logs to catalog all cloud applications in use and assess their risk posture. It provides visibility into sanctioned and unsanctioned apps but does not profile user activities or detect behavioral anomalies. Because the task is to detect unusual user behavior, App Discovery is not the correct feature.
- ✗
Cloud Discovery
Why it's wrong here
Cloud Discovery is the underlying mechanism that processes raw logs to map cloud app usage, producing reports with user counts, data volumes, and risk scores for each application. While it supports governance and policy enforcement, it is fundamentally an inventory and visibility tool that lacks the machine learning user entity behavior analytics necessary to flag anomalous activities. Thus it cannot fulfill the requirement for anomaly detection.
- ✓
Anomaly Detection policies
Why this is correct
Anomaly Detection policies are the correct selection because they leverage User and Entity Behavior Analytics (UEBA) in Microsoft Defender for Cloud Apps to establish a baseline of normal user behavior and then generate alerts for deviations such as impossible travel, anonymous IP access, or mass file download. These policies employ machine learning to detect suspicious activities and can automatically trigger governance actions, directly meeting the security administrator's goal.
- ✗
Conditional Access App Control
Why it's wrong here
Conditional Access App Control is a reverse proxy that enforces real-time access and session policies, such as blocking downloads, requiring multi-factor authentication, or restricting device access on cloud apps. It operates as a preventive control on active sessions and does not perform historical behavior analysis or identify anomalies. Therefore, it is not suited for detecting unusual user activity patterns in this scenario.
Go deeper
Related to this question
About these practice questions
This MS-102 question is part of Courseiva's 712-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.