MS-102 Practice Question: Manage security and threats by using Microsoft Defender XDR
Your organization uses Microsoft Defender for Cloud Apps. You discover that a user is accessing a sanctioned cloud app from an unknown IP address. You want to require multi-factor authentication (MFA) for this access. What should you configure?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create an access policy
An access policy in Microsoft Defender for Cloud Apps can enforce conditional access controls, such as requiring multi-factor authentication (MFA), based on conditions like IP address. Option A is incorrect because file policies govern file sharing and cannot enforce MFA. Option C is incorrect because session policies monitor and control user activity in real time but do not directly enforce MFA. Option D is incorrect because app discovery policies identify shadow IT and do not control access conditions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a file policy
Why it's wrong here
File policies scan and govern files in connected cloud apps, applying labels, quarantine or DLP actions; they do not evaluate sign-in context or enforce authentication. They are correct when protecting sensitive content. Requiring MFA for a sanctioned app from an unknown IP needs a Microsoft Entra ID Conditional Access policy.
- ✓
Create an access policy
Why this is correct
A Microsoft Defender for Cloud Apps access policy evaluates session conditions such as the source IP address and can enforce step-up controls, including requiring MFA, for the sanctioned app. This satisfies the requirement to challenge access originating from the unknown IP address.
- ✗
Create a session policy
Why it's wrong here
Session policies apply real-time controls such as download blocking or watermarking to an already-established app session; they cannot demand MFA at sign-in. They suit protecting data during active sessions. Requiring MFA for a sanctioned app from an unknown IP needs a Microsoft Entra ID Conditional Access policy.
- ✗
Create an app discovery policy
Why it's wrong here
App discovery policies classify unsanctioned apps and generate alerts or governance actions; they cannot enforce conditional access controls on sessions. They suit identifying shadow IT usage. Requiring MFA for a sanctioned app from a risky IP needs a Microsoft Entra ID Conditional Access policy, optionally integrated via Defender for Cloud Apps.
Go deeper
Related to this question
Learn chapter
Emergency Access (Break-Glass) Accounts
Key term
MFA
Multi-Factor Authentication (MFA) is a security method that requires a user to verify their identity using two or more different types of evidence, such as a password plus a code from a phone, before they can access an account or system.
Key term
Conditional access
Conditional access is a security framework that evaluates signals like user location, device health, and risk level to grant or block access to resources in real time.
About these practice questions
Courseiva writes every MS-102 question from scratch — 712 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.