Describe Microsoft 365 apps and services →mediumMultiple Choice

MS-900 Describe Microsoft 365 apps and services Practice Question

Exhibit

{
  "IsEnabled": true,
  "Urls": ["https://contoso.sharepoint.com/sites/ProjectX"],
  "BlockDownload": true,
  "AccessType": "Block",
  "IPRange": ["192.168.1.0/24"]
}

Refer to the exhibit. You are reviewing a Microsoft Defender for Cloud Apps access policy configuration. What does this policy do?

⚠ Common exam trap

The trap here is that candidates often focus on the 'Download' control and assume the policy only restricts downloads (Option A), overlooking that the 'Access' action is set to 'Block', which completely denies access from the specified IP range.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Blocks access from the specified IP range to the SharePoint site and prevents downloads

This policy is configured with an action of 'Block' and a 'Download (including printing)' control set to 'Block' for the specified IP range. When both access and download are blocked, the result is that users from that IP range are completely denied access to the SharePoint site and cannot download any files. Option C correctly describes this combined blocking behavior.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Allows access but prevents downloads from the specified IP range
Why it's wrong here
The policy is configured with an access action of 'Block', not 'Allow'. An 'Allow' policy would explicitly grant access, whereas the exhibited rule uses 'Block' to deny requests from the specified IP range. Additionally, the 'Download' action is set to 'Block', so the policy not only prevents downloads but also blocks all access to the SharePoint site from that range.
✗
Allows access to the SharePoint site only from the specified IP range
Why it's wrong here
It misreads the policy's access decision. The rule is set to 'Block' access from the specified IP range, meaning it denies requests from that range, rather than restricting access to only that range. An 'Allow' access entry with a condition would be required to permit access solely from those IPs, but the exhibit clearly shows 'Block' as the access action.
✓
Blocks access from the specified IP range to the SharePoint site and prevents downloads
Why this is correct
This is the correct description. The policy's access rule is set to 'Block', which denies all access to the SharePoint site from the specified IP range. Independently, the download rule is also set to 'Block', so even if access were permitted by another policy, downloads would be prevented. Together, the policy imposes both an access block and a download block for that IP range.
✗
Disables the policy for the SharePoint site
Why it's wrong here
The policy's 'IsEnabled' property is set to 'True', indicating that the policy is actively enforced. A disabled policy would have 'IsEnabled' set to 'False' and would not apply any access or download restrictions. The exhibit shows no disabling condition, so the policy remains active for the SharePoint site.

Go deeper

MS-900 Describe Microsoft 365 apps and services Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question