SC-200 Manage a security operations environment Practice Question
You are managing Microsoft Defender for Cloud Apps. You discover that a user is downloading large amounts of data from a sanctioned cloud app. You need to automatically suspend the user's access when the download exceeds 5 GB in 10 minutes. What should you create?
⚠ Common exam trap
Test-takers frequently confuse session policies (which block actions in real-time) with anomaly detection policies (which trigger automated responses like suspension based on behavioral patterns), leading them to choose Option B instead of A.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
An anomaly detection policy with a mass download detection template.
An anomaly detection policy in Microsoft Defender for Cloud Apps can detect unusual user behavior, such as mass file downloads, using predefined templates like 'Mass download by a single user'. This policy can be configured to trigger automatic governance actions, including suspending the user, when the download exceeds a threshold like 5 GB in 10 minutes. It directly addresses the need to automatically suspend access based on volume and time.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
An anomaly detection policy with a mass download detection template.
Why this is correct
An anomaly detection policy with a mass download detection template is the correct choice because Defender for Cloud Apps uses these built-in UEBA-based policies to establish a per-user baseline of normal activity and flag when a single user downloads a file volume that deviates significantly from that history. This template is specifically designed to detect mass download activity that is characteristic of data exfiltration, and once triggered, the policy can be configured with governance actions such as automatically suspending the user's account and sending an alert to your security team. It is the only option here that responds to aggregate download volume over time rather than to individual session or file characteristics.
- ✗
A session policy to block downloads.
Why it's wrong here
A session policy is incorrect here because session policies in Defender for Cloud Apps operate in real time through conditional access controls, evaluating each individual session at the moment a request occurs—for example, to block a single download based on file sensitivity, user risk, or location. They do not have a memory of historical activity or a baseline of normal user behavior, so they cannot detect that a user's cumulative download volume over a given period is unusually high. While you could use a session policy to block one suspicious download as it happens, it will not trigger governance actions such as account suspension when a pattern of mass downloading accumulates across many separate sessions, which is exactly what this scenario describes.
- ✗
An app connector for the cloud app.
Why it's wrong here
An app connector is the wrong option because it is essentially an API integration that gives Defender for Cloud Apps visibility into a cloud provider's activities, files, accounts, and logs, but it is not a detection or response mechanism on its own. When you add an app connector, you are enabling the underlying data flow so that other policies—such as anomaly detection policies—can analyze that data, but the app connector itself neither evaluates download volume nor executes automated actions like suspending a user. It is a prerequisite for pulling the activity data that would allow a mass download policy to work, not a substitute for creating and enabling that policy.
- ✗
A data loss prevention (DLP) policy in Microsoft Purview.
Why it's wrong here
A Microsoft Purview DLP policy is not an appropriate solution because Purview DLP focuses on content inspection and protecting sensitive data—such as credit card numbers, PII, or other regulated information—when it is shared, transferred, or used in supported apps like Exchange, SharePoint, and OneDrive. It cannot assess behavioral signals like an unusual volume of downloads across a cloud app, nor does it have access to Defender for Cloud Apps' UEBA anomaly detection engine. Additionally, DLP policies are configured and managed in the Microsoft Purview compliance portal, separate from Defender for Cloud Apps, and they are not designed to apply a 'suspend user' governance action for a mass download anomaly—they would instead target location or content-based conditions.
Go deeper
Related to this question
About these practice questions
One of 673 original SC-200 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.