Design solutions that align with security best practices and priorities →mediumMultiple ChoiceObjective-mapped
Detect Anomalous User Behavior Across Cloud Apps with Defender for Cloud Apps
A company deploys Microsoft Defender for Cloud Apps. They need to detect anomalous behavior in user activities across multiple cloud apps. Which feature should they enable?
Quick Answer
The answer is anomaly detection policies. This is the correct choice because Microsoft Defender for Cloud Apps uses machine learning and behavioral analytics to establish a baseline of normal user activity, then triggers alerts when deviations occur—such as impossible travel, mass file downloads, or ransomware-like behavior—across connected cloud apps. On the Microsoft Cybersecurity Architect exam, this concept tests your understanding of how to operationalize threat detection in a multi-cloud environment; a common trap is confusing anomaly detection with activity policies, which rely on static rules rather than adaptive baselines. Remember the memory tip: “Anomaly adapts, activity adheres”—anomaly detection learns normal patterns over time, while activity policies simply enforce fixed conditions.
⚠ Common exam trap
Candidates often confuse session policies (which enforce real-time access controls) with anomaly detection policies (which analyze historical patterns), leading them to select session policies when the question specifically asks for detecting anomalous behavior rather than controlling it.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Anomaly detection policies
Anomaly detection policies in Microsoft Defender for Cloud Apps are specifically designed to identify unusual patterns in user activities across connected cloud apps, such as impossible travel, mass file downloads, or ransomware-like behavior. These policies leverage machine learning and behavioral analytics to establish a baseline of normal user behavior and trigger alerts when deviations occur, making them the correct choice for detecting anomalous behavior.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Session policies
Why it's wrong here
Session policies control access in real time, not detect anomalies.
- ✓
Anomaly detection policies
Why this is correct
This is the correct feature for detecting anomalous user activities.
- ✗
Data loss prevention policies
Why it's wrong here
DLP policies focus on data protection, not behavioral anomalies.
- ✗
App governance
Why it's wrong here
App governance manages OAuth apps, not user behavior anomalies.
Go deeper
Related to this question
About these practice questions
One of 208 original SC-100 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SC-100
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Your organization uses Microsoft Defender for Cloud Apps. You need to detect anomalous behavior such as impossible travel. What should you configure?
easy- ✓ A.Anomaly detection policies in Microsoft Defender for Cloud Apps
- B.Data loss prevention (DLP) policies in Microsoft Purview
- C.Session policies in Microsoft Defender for Cloud Apps
- D.App permission policies in Microsoft Entra ID
Why A: Microsoft Defender for Cloud Apps uses anomaly detection policies to detect impossible travel and other suspicious activities. Option B is wrong because DLP policies focus on data protection, not activity anomalies. Option C is wrong because app permissions are for OAuth apps. Option D is wrong because session policies control real-time access, not anomaly detection.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-100 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-100 exam.