Block Downloads of Highly Confidential Files to Unmanaged Devices
Your organization has Microsoft Defender for Cloud Apps (MCAS) deployed. You need to create a policy that automatically blocks downloads of files classified as 'Highly Confidential' from SharePoint Online to unmanaged devices. Which policy type should you use?
Quick Answer
The answer is a session policy. This is correct because Microsoft Defender for Cloud Apps session policies use reverse proxy architecture to intercept and control user actions in real-time, allowing you to block downloads of highly confidential files to unmanaged devices based on device state tags like "unmanaged" or "compliant." On the MS-102 exam, this question tests your ability to distinguish between policy types: access policies control sign-in conditions, activity policies trigger alerts but don’t block in real-time, and app discovery policies identify shadow IT—only session policies enforce granular, real-time download blocks. A common trap is confusing session policies with access policies, but remember: session policies act on the session itself (like downloads), while access policies act on entry (like login). Memory tip: think “Session = Screen” for real-time control, not just entry or alerts.
⚠ Common exam trap
It's easy for candidates to confuse Access policies (which control who can access the app) with Session policies (which control what users can do within the app), leading them to incorrectly choose Option A when the question specifically requires blocking a file download action.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Session policy
A session policy in Microsoft Defender for Cloud Apps (MCAS) is the correct choice because it enables real-time monitoring and control of user activities in cloud apps, such as blocking downloads based on file sensitivity labels. This policy type uses reverse proxy architecture to inspect and intervene in user sessions, allowing you to block downloads of 'Highly Confidential' files from SharePoint Online to unmanaged devices.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Access policy
Why it's wrong here
Controls sign-in conditions, not file downloads.
- ✗
Activity policy
Why it's wrong here
Monitors activities but does not block in real-time.
- ✗
App discovery policy
Why it's wrong here
Identifies shadow IT, not controls file downloads.
- ✓
Session policy
Why this is correct
Uses reverse proxy to control actions in real-time.
Go deeper
Related to this question
Learn chapter
Microsoft 365 Tenant Setup
Key term
SharePoint Online
SharePoint Online is a cloud-based collaboration platform from Microsoft that lets teams create, store, organize, and share content securely from anywhere.
Key term
Policy
A policy is a set of rules or guidelines that defines how an organization manages, secures, and operates its IT systems and services.
About these practice questions
One of 241 original MS-102 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on MS-102
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Your organization uses Microsoft Defender for Cloud Apps. You discover that a user is accessing sensitive data from an unmanaged device. You need to automatically restrict the user's access to sensitive data until the device is compliant. What should you configure?
hard- ✓ A.Create a session policy that monitors and controls access to sensitive data
- B.Create a Conditional Access App Control policy for all apps
- C.Create an anomaly detection policy
- D.Create an app discovery policy
Why A: A session policy in Microsoft Defender for Cloud Apps can monitor and control access in real time. You can configure it to block or restrict access to sensitive data from unmanaged devices until the device becomes compliant. Option B is incorrect because Conditional Access App Control policies are used for broader conditional access scenarios, not specifically for device compliance monitoring at the app level. Option C is incorrect because anomaly detection policies are designed to detect suspicious activities, not to restrict access based on device compliance. Option D is incorrect because app discovery policies are used to discover and analyze cloud app usage, not to control access.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.