MS-102 Deploy and manage a Microsoft 365 tenant Practice Question
Your organization has a Microsoft 365 E5 tenant with Microsoft Defender for Cloud Apps. You need to discover and control the use of unsanctioned cloud apps. Which TWO actions should you take? (Choose two.)
⚠ Common exam trap
A common mix-up: candidates confuse Conditional Access policies with the ability to block unsanctioned apps, but Conditional Access requires the app to be registered in Entra ID and cannot discover or block apps that are not already known to the tenant.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Define sanctioned and unsanctioned app categories in Microsoft Defender for Cloud Apps
Microsoft Defender for Cloud Apps allows you to define sanctioned and unsanctioned app categories within the Cloud Discovery dashboard. By categorizing apps, you can apply governance actions such as blocking or monitoring, which directly controls the use of unsanctioned cloud apps. This is a foundational step in managing app usage, as it enables automated policies to enforce your organization's cloud app governance.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Define sanctioned and unsanctioned app categories in Microsoft Defender for Cloud Apps
Why this is correct
After discovery, you categorize apps to control access.
- ✗
Deploy Microsoft Purview Data Loss Prevention policies
Why it's wrong here
Purview DLP protects data, not discovers apps.
- ✗
Configure Microsoft Entra ID App Registrations to log app usage
Why it's wrong here
App Registrations are for developing apps, not discovering unsanctioned apps.
- ✓
Use Cloud Discovery in Microsoft Defender for Cloud Apps to analyze traffic logs
Why this is correct
Cloud Discovery identifies unsanctioned apps from traffic logs.
- ✗
Create a Conditional Access policy to block all unsanctioned apps
Why it's wrong here
Conditional Access can block apps, but you need to discover them first.
Go deeper
Related to this question
About these practice questions
This MS-102 question is part of Courseiva's 241-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.