The answer is enabling Conditional Access App Control and deploying app connectors. These two configurations are required to enable Microsoft Defender for Cloud Apps monitoring because app connectors establish API-based integrations with cloud applications like Office 365 or Salesforce, allowing the service to ingest activity logs, file metadata, and user sessions for threat detection, while Conditional Access App Control enforces real-time access policies to monitor and control user sessions. On the Microsoft Cybersecurity Architect exam, this tests your understanding of how Defender for Cloud Apps operates at both the data plane (via connectors) and the control plane (via session policies). A common trap is assuming that simply enabling the service in the portal is enough, but without both components, monitoring remains incomplete. Remember the mnemonic “Connect and Control”—connectors bring the data in, and Conditional Access App Control governs the user experience.
SC-100 Practice Question: Design security operations, identity, and compliance capabilities
This SC-100 practice question tests your understanding of design security operations, identity, and compliance capabilities. The scenario asks you to isolate a root cause — eliminate options that address a different problem before choosing. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
Which TWO configurations are required to enable Microsoft Defender for Cloud Apps to monitor cloud app usage?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add app connectors for the cloud apps you want to monitor
A is correct because Microsoft Defender for Cloud Apps requires app connectors to establish API-based connections with cloud applications (e.g., Office 365, Salesforce, AWS). These connectors enable the service to ingest activity logs, file metadata, and user sessions for monitoring and threat detection. Without app connectors, Defender for Cloud Apps cannot access the cloud app's data plane to perform its core monitoring functions.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✓
Add app connectors for the cloud apps you want to monitor
Why this is correct
App connectors enable API-based monitoring.
Related concept
Read the scenario before looking for a memorised answer.
✗
Configure Microsoft Intune device compliance policies
Why it's wrong here
Intune policies are for device management.
✗
Deploy Azure Information Protection scanner
Why it's wrong here
Scanner is for on-premises data classification.
✗
Synchronize with Microsoft Entra ID
Why it's wrong here
Synchronization is automatic; not a configuration.
✓
Enable Conditional Access App Control
Why this is correct
App control allows real-time session monitoring.
Related concept
Read the scenario before looking for a memorised answer.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates often confuse prerequisites (like Microsoft Entra ID sync) with the actual enabling configurations, or they assume device compliance policies (Intune) are required for cloud app monitoring when they are only relevant for conditional access grant controls.
Detailed technical explanation
How to think about this question
App connectors use OAuth 2.0 delegated permissions to authenticate against the cloud app's API, allowing Defender for Cloud Apps to pull activity logs and file metadata via RESTful endpoints (e.g., Office 365 Management Activity API). Conditional Access App Control works as a reverse proxy, intercepting user traffic at the session level to enforce real-time policies (e.g., block download) based on user and device signals. In a real-world scenario, an organization might deploy both: app connectors for historical log analysis and Conditional Access App Control for granular session policies on unmanaged devices.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A company's IT admin needs to give a contractor read-only access to production logs without sharing account credentials. Using role-based access control (RBAC) and temporary scoped permissions — not a permanent shared password — is the correct pattern. Questions like this test whether you can apply least-privilege access across cloud identity services.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this SC-100 question in full detail.
Design security operations, identity, and compliance capabilities — This question tests Design security operations, identity, and compliance capabilities — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Add app connectors for the cloud apps you want to monitor — A is correct because Microsoft Defender for Cloud Apps requires app connectors to establish API-based connections with cloud applications (e.g., Office 365, Salesforce, AWS). These connectors enable the service to ingest activity logs, file metadata, and user sessions for monitoring and threat detection. Without app connectors, Defender for Cloud Apps cannot access the cloud app's data plane to perform its core monitoring functions.
What should I do if I get this SC-100 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Your organization is deploying Microsoft Defender for Cloud Apps. Which THREE capabilities are included in Defender for Cloud Apps? (Select three.)
medium
✓ A.Session controls
✓ B.App governance
✓ C.Cloud Discovery
D.Data Loss Prevention (DLP) policies
E.Conditional Access
Why A: Defender for Cloud Apps provides Cloud Discovery (discover shadow IT), app governance (control app permissions), and session controls (protect data in real time). Conditional Access is an Entra ID feature, and DLP policies are part of Microsoft Purview, though Cloud Apps can integrate with them.
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This SC-100 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-100 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.