SC-200 Conditional Access Practice Question
You are configuring Microsoft Defender for Cloud Apps session controls for a SharePoint site containing sensitive data. Which condition must be met to apply real-time monitoring?
⚠ Common exam trap
Candidates often confuse the Microsoft Entra ID application proxy with the Cloud App Security proxy. For SharePoint Online session controls, Conditional Access policies trigger the Cloud App Security proxy, not the application proxy.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Users must be configured with Conditional Access policies from Microsoft Entra ID.
Microsoft Defender for Cloud Apps session controls for SharePoint require users to be routed through the Cloud App Security proxy, which is invoked by Conditional Access policies in Microsoft Entra ID. Conditional Access app controls apply session policies to traffic when users access SharePoint, enabling real-time monitoring. The Microsoft Entra ID application proxy is designed for on-premises apps, not for SaaS apps like SharePoint Online. Therefore, the correct prerequisite is having Conditional Access policies configured.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The SharePoint site must be added as a custom app in Defender for Cloud Apps.
Why it's wrong here
SharePoint Online is already a recognized, first-party cataloged SaaS app in Microsoft Defender for Cloud Apps, so it does not need to be added as a custom app. Custom apps are used for lifting unsupported third-party cloud applications into cloud discovery and session control. Because SharePoint is natively integrated, any session control configuration only requires selecting the SharePoint app in the Conditional Access policy and enabling the appropriate control in Defender for Cloud Apps—no manual custom app registration is involved.
- ✗
Users must access the site through Microsoft Entra ID application proxy.
Why it's wrong here
The Microsoft Entra ID application proxy is designed for publishing and accessing on-premises or legacy applications through an outbound connection to Microsoft's cloud service. It does not apply to SharePoint Online, which is already a native cloud app. Session controls for SaaS apps such as SharePoint rely on Conditional Access policies and the Defender for Cloud Apps reverse proxy, a separate mechanism that works by redirecting the user's session rather than by routing through the application proxy endpoint.
- ✗
A browser extension must be installed on all client devices.
Why it's wrong here
A browser extension is not required for session controls that protect SharePoint Online. The Microsoft Entra ID and Defender for Cloud Apps integration operates at the network proxy level, not inside the client browser. The end-user's browser simply follows authentication and redirection prompts, and the proxy inspects traffic server-side, so there is no need to deploy or maintain client-side add-ons, unlike some legacy on-premises gateway solutions that require a client component.
- ✓
Users must be configured with Conditional Access policies from Microsoft Entra ID.
Why this is correct
Session controls in Microsoft Defender for Cloud Apps are implemented through the Conditional Access session control pipeline in Microsoft Entra ID. When a user is subject to a Conditional Access policy that includes 'Use Conditional Access App Control' as a session control, the user's session is redirected through the Defender for Cloud Apps reverse proxy. Without this policy, the proxy never intercepts the request, so session-level monitoring and restrictions (e.g., download blocking) will not be enforced for SharePoint Online.
Go deeper
Related to this question
About these practice questions
One of 209 original SC-200 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.