Activity Policy for File Download Thresholds
Your SOC uses Microsoft Sentinel and Microsoft Defender for Cloud Apps. You need to configure a policy that triggers when a user downloads a large number of files from SharePoint Online within a short period. Which policy type should you use?
Quick Answer
The correct choice is an activity policy, because it is specifically designed in Microsoft Defender for Cloud Apps to monitor user behaviors like file downloads and trigger alerts when a defined threshold is exceeded within a short time window. Unlike other policy types, such as anomaly detection or session policies, an activity policy allows you to set precise conditions—for example, “more than 50 file downloads from SharePoint Online in 10 minutes”—and respond with governance actions like suspending the user or requiring re-authentication. On the SC-200 exam, this question tests your ability to distinguish between Defender for Cloud Apps policy types, often presenting a trap where candidates confuse activity policies with anomaly detection policies; remember that anomaly detection uses built-in machine learning, while activity policies rely on manually configured thresholds. A useful memory tip: think of “activity” as “action with a number”—if you can set a specific count or rate, it’s an activity policy.
⚠ Common exam trap
A common mix-up: candidates confuse anomaly detection policies (which are predefined and use machine learning) with activity policies (which are customizable and rule-based), leading them to select anomaly detection when a custom threshold-based trigger is required.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Activity policy
An activity policy in Microsoft Defender for Cloud Apps is designed to monitor and respond to specific user activities, such as downloading a large number of files from SharePoint Online within a short period. This policy type allows you to set thresholds and triggers based on user actions, making it the correct choice for detecting anomalous download behavior.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Session policy
Why it's wrong here
Session policies apply real-time controls to active user sessions, such as blocking downloads or requiring authentication, rather than generating alerts on download volume. It would be correct when you need to restrict or govern what a user can do during a live session.
- ✗
File policy
Why it's wrong here
File policies apply to files in connected cloud storage services such as OneDrive and SharePoint, but they enforce governance actions like retention or DLP, not volume-based download thresholds. It would be correct for classifying or protecting files, not detecting mass downloads.
- ✗
Anomaly detection policy
Why it's wrong here
Anomaly detection policies in Defender for Cloud Apps learn baseline user behaviour and flag deviations, but they cannot express a deterministic threshold such as a specific file count within a defined window. It would be correct for detecting unusual activity patterns without predefined rules.
- ✓
Activity policy
Why this is correct
Activity policies in Microsoft Defender for Cloud Apps evaluate user activity against thresholds, such as mass file downloads from SharePoint Online within a defined period. They generate alerts or governance actions directly on the activity stream, matching the download-volume scenario.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SC-200 question from scratch — 1,303 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SC-200
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Your organization uses Microsoft Defender for Cloud Apps. You need to create a policy that alerts when a user downloads more than 10 files from SharePoint in 5 minutes. What type of policy should you create?
medium- ✓ A.Activity policy
- B.App permissions policy
- C.Session policy
- D.Anomaly detection policy
Why A: An Activity policy in Microsoft Defender for Cloud Apps is designed to monitor and respond to specific user activities, such as file downloads from SharePoint, based on predefined thresholds. By configuring the policy with a threshold of more than 10 downloads within 5 minutes, it triggers an alert when the activity exceeds this limit, enabling detection of potential data exfiltration or anomalous user behavior.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.