Design security operations, identity, and compliance capabilities →mediumMultiple ChoiceObjective-mapped
SC-100 Practice Question: Design security operations, identity, and compliance capabilities
Your company uses Microsoft Defender for Cloud Apps and wants to prevent users from uploading sensitive files to personal cloud storage apps. What should you configure?
⚠ Common exam trap
It's easy for candidates to confuse 'File policy' (which governs files at rest) with 'Session policy' (which governs files in motion), leading them to select D, even though real-time upload prevention requires session-level control via reverse proxy.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Session policy
Session policy in Microsoft Defender for Cloud Apps allows real-time monitoring and control of user activities based on app and content inspection. By configuring a session policy, you can block or restrict uploads of sensitive files to personal cloud storage apps like Dropbox or Google Drive during the user's session, leveraging reverse proxy capabilities to inspect and intervene in traffic.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Activity policy
Why it's wrong here
Activity policies in Defender for Cloud Apps are rule-based detection mechanisms that monitor user activities across connected applications, raising alerts when behavior matches conditions such as impossible travel or repeated failed sign-ins. Because they operate on activity logs after the action has already been executed, they are purely reactive and cannot intercept or block a file upload in real time. Therefore, an activity policy can detect anomalous uploads but cannot satisfy the requirement to block them.
- ✗
App connector
Why it's wrong here
App connectors are API-based integrations that allow Defender for Cloud Apps to ingest data from SaaS platforms such as Microsoft 365, Salesforce, or Box for visibility into users, files, and activity. They provide the underlying telemetry that policies rely on, but the API pull model introduces latency and is not in the user's traffic path. Consequently, app connectors cannot enforce real-time controls like blocking an upload; they only enable later detection and governance.
- ✓
Session policy
Why this is correct
Session policies, part of Conditional Access App Control, route user traffic through Defender for Cloud Apps as a reverse proxy, allowing synchronous inspection of each request and response. The proxy can evaluate conditions like device compliance, user risk, or file sensitivity and then block, allow, or restrict actions — including preventing uploads to unsanctioned apps before the request is passed through. This real-time inline enforcement is exactly what the scenario requires, making session policy the correct choice.
- ✗
File policy
Why it's wrong here
File policies in Defender for Cloud Apps inspect files that are already stored in connected cloud apps, matching them against DLP profiles, permissions, or metadata and triggering governance actions such as quarantining or changing sharing links. Because they evaluate the file after it has been uploaded and tokenized, they cannot deny the original upload request mid-session. Thus file policies help remediate standing data but do not provide the real-time upload blocking required here.
Go deeper
Related to this question
About these practice questions
This SC-100 question is part of Courseiva's 208-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-100 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-100 exam.