The correct action is to configure a session policy in Defender for Cloud Apps with both 'Block' and 'Require re-authentication' selected. This combination immediately terminates the user’s active session from the malicious IP and forces them to present fresh credentials, effectively blocking access while ensuring identity re-verification. Session policies enforce real-time conditional access controls on sanctioned apps, and the 'Block' action alone would stop the session but not compel the user to re-authenticate, leaving a potential gap if the same IP tries again. On the SC-200 exam, this scenario tests your understanding of how Defender for Cloud Apps session policies differ from access policies—access policies block at the app level, while session policies work inside the app session. A common trap is choosing only 'Block' without re-authentication, which fails to reset the user’s token. Memory tip: think “Block and bounce”—block the session, then bounce the user back to the login prompt.
SC-200 Manage a security operations environment Practice Question
This SC-200 practice question tests your understanding of manage a security operations environment. This is a configuration task: choose the command set that satisfies every stated requirement. Small differences — like 'secret' vs 'password' or 'transport input ssh' vs 'all' — change whether the answer is correct. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
Your company uses Microsoft Defender for Cloud Apps to monitor cloud applications. You have discovered that a user is accessing a sanctioned cloud storage app from an IP address that belongs to a known malicious botnet. You need to automatically block the user's access to the app and require them to re-authenticate. You have already configured session policies in Defender for Cloud Apps. What should you do next?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure a session policy in Defender for Cloud Apps with the action 'Block' and 'Require re-authentication'.
Session policies in Defender for Cloud Apps can enforce real-time controls on sanctioned apps. By configuring a session policy with the actions 'Block' and 'Require re-authentication', you can immediately terminate the user's session and force them to re-authenticate, which effectively blocks access from the malicious IP while ensuring the user re-verifies their identity.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Create an access policy in Defender for Cloud Apps to block the user.
Why it's wrong here
Access policies block but do not force re-authentication.
✗
Create an app governance policy in Microsoft Purview to block the app.
Why it's wrong here
App governance is for oversight, not real-time blocking.
✓
Configure a session policy in Defender for Cloud Apps with the action 'Block' and 'Require re-authentication'.
Why this is correct
Session policies can block and force re-authentication via conditional access.
Related concept
Read the scenario before looking for a memorised answer.
✗
Create a device compliance policy in Microsoft Intune to block the device.
Why it's wrong here
Device compliance does not block cloud app access in real-time.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is confusing session policies with access policies; access policies only block or allow at the app level without session-level controls like re-authentication, while session policies provide the granular, real-time actions needed for this scenario.
Detailed technical explanation
How to think about this question
Session policies use reverse proxy architecture to intercept user traffic to sanctioned apps, allowing granular controls like blocking downloads or requiring re-authentication. The 'Require re-authentication' action forces the user to present fresh credentials or MFA, which is critical when a session is initiated from a known malicious IP, as it can detect account compromise even if the initial authentication was valid. This approach leverages Conditional Access App Control, which integrates with Azure AD to enforce policies in real time.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A media company stores terabytes of video archives that are accessed once a year for audit purposes. Moving these objects to a cold storage tier (Azure Archive, S3 Glacier, or Google Nearline) costs a fraction of hot storage. Questions like this test whether you understand storage tiers, access frequency tradeoffs, and retrieval latency requirements.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this SC-200 question in full detail.
Manage a security operations environment — This question tests Manage a security operations environment — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Configure a session policy in Defender for Cloud Apps with the action 'Block' and 'Require re-authentication'. — Session policies in Defender for Cloud Apps can enforce real-time controls on sanctioned apps. By configuring a session policy with the actions 'Block' and 'Require re-authentication', you can immediately terminate the user's session and force them to re-authenticate, which effectively blocks access from the malicious IP while ensuring the user re-verifies their identity.
What should I do if I get this SC-200 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Your company uses Microsoft Defender for Cloud Apps. You discover that a user is accessing sensitive data from an unfamiliar IP address. You need to immediately block the user's access to all cloud apps while preserving the session for investigation. What should you do?
medium
✓ A.Use the 'Block' governance action in Defender for Cloud Apps
B.Create a conditional access policy to block the IP
C.Add the IP to the blocked IP address range list
D.Suspend the user from Microsoft Entra ID
Why A: The 'Block' governance action in Defender for Cloud Apps immediately blocks the user's access to all cloud apps while preserving the session for investigation. This action is applied directly within the Defender for Cloud Apps portal, allowing you to stop data exfiltration without disrupting the ability to analyze the session logs or alerts. It is the only option that meets the requirement of blocking access while keeping the session intact for forensic review.
Variation 2. You are configuring Microsoft Defender for Cloud Apps to enhance visibility into your organization's SaaS app usage. You need to ensure that risky user activities are automatically suspended. What should you configure?
easy
A.Set up IP address range policies.
B.Configure app discovery policies.
✓ C.Create a session policy to block or limit activities based on risk.
D.Define file policies to protect sensitive data.
Why C: Option B is correct because session policies allow real-time control of user sessions based on risk level. Option A is wrong because app discovery only identifies apps used. Option C is wrong because file policies govern data protection. Option D is wrong because IP address ranges are used for location-based policies, not activity control.
Last reviewed: Jun 25, 2026
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.