Courseiva
← SC-200
Full test
Perform threat hunting →hardMultiple ChoiceObjective-mapped

SC-200 Perform threat hunting Practice Question

A threat hunter is investigating a potential data exfiltration incident. The hunter suspects that a user is using an unauthorized cloud storage service. Which Microsoft Defender for Cloud Apps signal would be most useful to detect this activity?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Cloud Discovery

Defender for Cloud Apps can discover shadow IT cloud apps. Option B is wrong because it does not detect cloud app usage. Option C is wrong because it is for web filtering, not cloud apps. Option D is wrong because it is for email protection.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • ✓

    Cloud Discovery

    Why this is correct

    Cloud Discovery identifies shadow IT and cloud app usage.

  • ✗

    Microsoft Defender for Endpoint Web Protection

    Why it's wrong here

    Web Protection blocks malicious websites, not cloud app detection.

  • ✗

    Microsoft Defender for Identity

    Why it's wrong here

    Defender for Identity detects on-premises identity threats, not cloud app usage.

  • ✗

    Microsoft Defender for Office 365 Safe Links

    Why it's wrong here

    Safe Links protects against malicious URLs, not cloud app discovery.

About these practice questions

One of 209 original SC-200 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.