hardMultiple ChoiceObjective-mapped
MS-900 Practice Question: A company with 100 Microsoft 365 E3 users needs…
A company with 100 Microsoft 365 E3 users needs to add cloud access security broker capabilities to monitor and control user access to SaaS applications and shadow IT. They want the most cost-effective add-on. What should they purchase?
⚠ Common exam trap
Many exam-takers confuse Microsoft Defender for Cloud Apps with Microsoft Defender for Microsoft 365 Plan 2, assuming the latter is required for CASB functionality, when in fact the standalone Defender for Cloud Apps license provides the same CASB capabilities at a lower cost.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Defender for Cloud Apps
Microsoft Defender for Cloud Apps is a Cloud Access Security Broker (CASB) that provides visibility into shadow IT, controls over user access to SaaS applications, and data protection policies. It is the most cost-effective add-on for this specific requirement because it can be licensed standalone without requiring higher-tier Microsoft 365 or Entra ID plans, and it directly addresses the need to monitor and control SaaS app usage.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Microsoft Defender for Cloud Apps
Why this is correct
Microsoft Defender for Cloud Apps is the correct add-on because it functions as a Cloud Access Security Broker (CASB). It discovers shadow IT by analyzing user web traffic and logs, assesses the risk of thousands of SaaS applications, and enforces access and data-control policies such as session governance and app-level conditional access. For a tenant with M365 E3, adding this service directly addresses the need to monitor and control unsanctioned SaaS usage across the organization.
- ✗
Microsoft Defender for Microsoft 365 Plan 2
Why it's wrong here
Microsoft Defender for Microsoft 365 Plan 2 is an add-on that extends the E3 security baseline with advanced email and collaboration protection, including post-delivery attack investigation, automated response, and threat hunting across Exchange, SharePoint, and Teams. It does not include CASB functionality, so it cannot discover or monitor the use of third-party SaaS applications or shadow IT. The scenario requires SaaS discovery, which is outside this add-on's scope.
- ✗
Microsoft Entra ID Premium P2
Why it's wrong here
Microsoft Entra ID Premium P2 is an identity and access management layer that provides conditional access, identity protection, and Privileged Identity Management (PIM). While it can enforce sign-in policies and respond to compromised identities, it does not analyze web traffic to discover which SaaS apps employees are using or measure their risk. It is not a CASB and would not bring visibility into shadow IT.
- ✗
Microsoft 365 E5 Compliance
Why it's wrong here
Microsoft 365 E5 Compliance is a suite of advanced compliance tools such as eDiscovery, retention policies, communication compliance, and information barriers. These features help organizations meet regulatory obligations and govern content, but they lack the cloud access security broker capabilities needed to monitor and control unsanctioned SaaS applications. CASB is a security feature, not a compliance one, so this add-on would not satisfy the shadow IT discovery requirement.
Go deeper
Related to this question
Learn chapter
Cloud Service Types for MS-900
Key term
Microsoft Defender
Microsoft Defender is a suite of security products that protects devices, data, and identities from cyber threats like malware, phishing, and unauthorized access.
Key term
Microsoft 365
Microsoft 365 is a subscription-based cloud service from Microsoft that combines productivity tools like Office apps with security, device management, and online storage.
About these practice questions
One of 217 original MS-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-900 exam.