The answer is Microsoft Defender for Cloud Apps. This solution is correct because it functions as a Cloud Access Security Broker (CASB), purpose-built for shadow IT discovery, risk scoring, and alerting on unsanctioned cloud app usage. It uses API connectors and log collectors to inventory all cloud apps in use, then assigns a risk score based on factors like compliance certifications, data encryption, and security controls, triggering alerts when a high-risk app is detected. On the SC-900 exam, this question tests your understanding of how Defender for Cloud Apps fits into the Microsoft security portfolio as the dedicated tool for discovering and assessing third-party SaaS apps—a common trap is confusing it with Microsoft Purview (which focuses on data governance) or Defender for Endpoint (which focuses on devices). Remember the mnemonic: “CASB for Cloud App Shadow Box”—CASB functions (Discovery, Risk Scoring, Alerts) are the core of Defender for Cloud Apps, and “Shadow Box” reminds you it uncovers hidden shadow IT.
SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
This SC-900 practice question tests your understanding of describe the capabilities of microsoft security solutions. Match the stated requirement to the specific cloud service, access model, or configuration option — many options are valid in isolation but not for this scenario. A key principle to apply: defender for Cloud Apps provides Cloud Discovery to identify Shadow IT.. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A company uses Microsoft 365 and many third-party SaaS apps like Salesforce and Box. The security team needs to discover which unsanctioned cloud apps employees are using (Shadow IT). They also want to get a risk score for each app and receive alerts when a high-risk app is used. Which Microsoft security solution should they use?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Defender for Cloud Apps
Microsoft Defender for Cloud Apps (MDCA) is the correct solution because it is specifically designed for Cloud Access Security Broker (CASB) functions, including Shadow IT discovery, risk scoring of cloud apps, and policy-based alerts. It integrates with Microsoft 365 and third-party SaaS apps via API connectors and log collectors to identify unsanctioned app usage and assign a risk score based on factors like compliance, security controls, and industry standards.
Key principle: Defender for Cloud Apps provides Cloud Discovery to identify Shadow IT.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Microsoft Defender for Endpoint
Why it's wrong here
Defender for Endpoint protects endpoints (computers, mobile devices) from threats, but does not discover Shadow IT cloud apps.
✗
Microsoft Defender for Identity
Why it's wrong here
Defender for Identity detects lateral movement and identity-based attacks in on-premises Active Directory, not cloud app discovery.
✓
Microsoft Defender for Cloud Apps
Why this is correct
Defender for Cloud Apps includes Cloud Discovery, which identifies used apps, assigns risk scores, and alerts on high-risk app usage.
Related concept
Defender for Cloud Apps provides Cloud Discovery to identify Shadow IT.
✗
Microsoft Purview Compliance Manager
Why it's wrong here
Compliance Manager helps manage compliance activities and provides a compliance score, but does not discover cloud app usage.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates confuse Microsoft Defender for Cloud Apps with other Defender products (Endpoint or Identity) because they all share the 'Defender' branding, but only Cloud Apps provides CASB capabilities for Shadow IT discovery and app risk scoring.
Detailed technical explanation
How to think about this question
Under the hood, Defender for Cloud Apps uses the Cloud App Catalog with over 31,000 apps, each scored on a 1–10 scale based on 80+ risk factors such as encryption standards (e.g., TLS 1.2), SOC 2 certification, and data-at-rest policies. Shadow IT discovery works by deploying log collectors that parse firewall and proxy logs (e.g., via FTP or syslog) to identify app traffic, then matching it against the catalog to generate a risk score and trigger alerts via policy-based actions like blocking or governance.
KKey Concepts to Remember
Defender for Cloud Apps provides Cloud Discovery to identify Shadow IT.
It assigns risk scores to discovered cloud applications based on various factors.
It can generate alerts for the usage of high-risk or unsanctioned apps.
Defender for Cloud Apps offers granular control and visibility over cloud app usage.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Defender for Cloud Apps provides Cloud Discovery to identify Shadow IT.
Real-world example
How this comes up in practice
A company's IT admin needs to give a contractor read-only access to production logs without sharing account credentials. Using role-based access control (RBAC) and temporary scoped permissions — not a permanent shared password — is the correct pattern. Questions like this test whether you can apply least-privilege access across cloud identity services.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this SC-900 question in full detail.
Review defender for Cloud Apps provides Cloud Discovery to identify Shadow IT., then practise related SC-900 questions on the same topic to reinforce the concept.
Describe the capabilities of Microsoft security solutions — This question tests Describe the capabilities of Microsoft security solutions — Defender for Cloud Apps provides Cloud Discovery to identify Shadow IT..
What is the correct answer to this question?
The correct answer is: Microsoft Defender for Cloud Apps — Microsoft Defender for Cloud Apps (MDCA) is the correct solution because it is specifically designed for Cloud Access Security Broker (CASB) functions, including Shadow IT discovery, risk scoring of cloud apps, and policy-based alerts. It integrates with Microsoft 365 and third-party SaaS apps via API connectors and log collectors to identify unsanctioned app usage and assign a risk score based on factors like compliance, security controls, and industry standards.
What should I do if I get this SC-900 question wrong?
Review defender for Cloud Apps provides Cloud Discovery to identify Shadow IT., then practise related SC-900 questions on the same topic to reinforce the concept.
What is the key concept behind this question?
Defender for Cloud Apps provides Cloud Discovery to identify Shadow IT.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.