Activity Policy for File Download Thresholds
Your SOC uses Microsoft Sentinel and Microsoft Defender for Cloud Apps. You need to configure a policy that triggers when a user downloads a large number of files from SharePoint Online within a short period. Which policy type should you use?
Quick Answer
The correct choice is an activity policy, because it is specifically designed in Microsoft Defender for Cloud Apps to monitor user behaviors like file downloads and trigger alerts when a defined threshold is exceeded within a short time window. Unlike other policy types, such as anomaly detection or session policies, an activity policy allows you to set precise conditions—for example, “more than 50 file downloads from SharePoint Online in 10 minutes”—and respond with governance actions like suspending the user or requiring re-authentication. On the SC-200 exam, this question tests your ability to distinguish between Defender for Cloud Apps policy types, often presenting a trap where candidates confuse activity policies with anomaly detection policies; remember that anomaly detection uses built-in machine learning, while activity policies rely on manually configured thresholds. A useful memory tip: think of “activity” as “action with a number”—if you can set a specific count or rate, it’s an activity policy.
⚠ Common exam trap
A common mix-up: candidates confuse anomaly detection policies (which are predefined and use machine learning) with activity policies (which are customizable and rule-based), leading them to select anomaly detection when a custom threshold-based trigger is required.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Activity policy
An activity policy in Microsoft Defender for Cloud Apps is designed to monitor and respond to specific user activities, such as downloading a large number of files from SharePoint Online within a short period. This policy type allows you to set thresholds and triggers based on user actions, making it the correct choice for detecting anomalous download behavior.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Session policy
Why it's wrong here
Session policies control access but do not trigger alerts for past downloads.
- ✗
File policy
Why it's wrong here
File policies are for file attributes, not activity patterns.
- ✗
Anomaly detection policy
Why it's wrong here
Anomaly detection policies are predefined and not as customizable for specific app behaviors.
- ✓
Activity policy
Why this is correct
Activity policies allow custom detection of specific activities like mass downloads.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SC-200 question from scratch — 209 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SC-200
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Your organization uses Microsoft Defender for Cloud Apps. You need to create a policy that alerts when a user downloads more than 10 files from SharePoint in 5 minutes. What type of policy should you create?
medium- ✓ A.Activity policy
- B.App permissions policy
- C.Session policy
- D.Anomaly detection policy
Why A: An Activity policy in Microsoft Defender for Cloud Apps is designed to monitor and respond to specific user activities, such as file downloads from SharePoint, based on predefined thresholds. By configuring the policy with a threshold of more than 10 downloads within 5 minutes, it triggers an alert when the activity exceeds this limit, enabling detection of potential data exfiltration or anomalous user behavior.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.