SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
A company uses Microsoft Defender for Cloud Apps to secure its cloud applications. The security team wants to monitor and control data activities in a third-party cloud app (e.g., Box) in real time. Specifically, they need to block downloads of files that have a 'Confidential' sensitivity label when users access the app from unmanaged devices. Which capability of Microsoft Defender for Cloud Apps should they configure?
⚠ Common exam trap
Many candidates confuse API-based app connectors (which control data at rest) with reverse proxy-based Conditional Access App Control (which controls data in motion during user sessions).
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Conditional Access App Control
Conditional Access App Control (CAAC) is the correct capability because it enforces real-time session policies that can block downloads based on sensitivity labels and device compliance. By integrating with Microsoft Defender for Cloud Apps, CAAC intercepts user sessions to third-party apps like Box and applies granular controls, such as blocking file downloads when the device is unmanaged and the file carries a 'Confidential' label.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Cloud Discovery
Why it's wrong here
Cloud Discovery is a component of Defender for Cloud Apps primarily designed to identify and assess the risk of cloud applications used by an organization's employees, often by analyzing traffic logs from firewalls and proxies. While it helps uncover 'shadow IT' and categorize applications, its function is limited to discovery and risk assessment, not real-time, session-level enforcement or control over data interactions within those applications.
When this WOULD be correct
An exam question asking how to identify which cloud apps are being used in an organization without prior approval, or to assess the risk profile of discovered apps, would make Cloud Discovery the correct answer.
- ✗
App connector
Why it's wrong here
App connectors provide API-based integration with specific cloud applications, allowing Defender for Cloud Apps to collect logs, scan files for sensitive information, and apply governance actions post-factum. While they offer robust controls and visibility into data at rest and in transit via API, they do not intercept or control user sessions in real-time as they occur, which is essential for immediate, dynamic data access restrictions during an active session.
When this WOULD be correct
An app connector would be correct if the question asked for a capability to apply policies (e.g., quarantine, apply labels) to files already stored in a third-party cloud app via API, without needing real-time session control or device-based conditions.
- ✓
Conditional Access App Control
Why this is correct
Conditional Access App Control integrates directly with Azure AD Conditional Access policies to route user sessions through Defender for Cloud Apps. This enables real-time monitoring and control over user activities within cloud applications, such as preventing data downloads, uploads, or copy-pasting based on policy conditions. This granular, session-level enforcement is crucial for securing data in real-time during active user sessions, making it the correct solution for immediate data access restrictions.
- ✗
Information protection
Why it's wrong here
Information protection, typically referring to Microsoft Purview Information Protection (MPIP), focuses on classifying, labeling, and encrypting sensitive data to ensure its protection wherever it resides or travels. While critical for data governance and persistent data security, it primarily deals with the data itself and its inherent security attributes, rather than providing real-time, session-based controls over how users interact with that data within cloud applications during an active session.
When this WOULD be correct
A company wants to automatically apply a 'Confidential' sensitivity label to files stored in a third-party cloud app (e.g., Box) that contain credit card numbers. They should configure Information Protection policies to scan and label files accordingly.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SC-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Conditional Access App ControlCorrect answer▾
Why this is correct
Conditional Access App Control integrates directly with Azure AD Conditional Access policies to route user sessions through Defender for Cloud Apps. This enables real-time monitoring and control over user activities within cloud applications, such as preventing data downloads, uploads, or copy-pasting based on policy conditions. This granular, session-level enforcement is crucial for securing data in real-time during active user sessions, making it the correct solution for immediate data access restrictions.
✗Cloud DiscoveryWrong answer — click to see why▾
Why this is wrong here
Cloud Discovery analyzes traffic logs to identify shadow IT and assess cloud app usage, but it does not provide real-time control over data activities like blocking downloads based on sensitivity labels.
★ When this WOULD be the correct answer
An exam question asking how to identify which cloud apps are being used in an organization without prior approval, or to assess the risk profile of discovered apps, would make Cloud Discovery the correct answer.
Why candidates choose this
Candidates may confuse Cloud Discovery with monitoring capabilities, thinking it can enforce real-time controls, or they may not distinguish between discovering apps and controlling actions within them.
✗App connectorWrong answer — click to see why▾
Why this is wrong here
An app connector provides API-based visibility and control for cloud apps, but it cannot enforce real-time blocking of downloads based on device state or sensitivity labels. The question requires session-level control, which is only possible with Conditional Access App Control.
★ When this WOULD be the correct answer
An app connector would be correct if the question asked for a capability to apply policies (e.g., quarantine, apply labels) to files already stored in a third-party cloud app via API, without needing real-time session control or device-based conditions.
Why candidates choose this
Candidates may confuse app connectors with the ability to control data activities, but they overlook that app connectors lack real-time, user-session-level enforcement based on device or label conditions.
✗Information protectionWrong answer — click to see why▾
Why this is wrong here
Information protection in Defender for Cloud Apps focuses on applying sensitivity labels and encryption to files, not on real-time control of access or blocking downloads based on device state. The question requires conditional access enforcement, which is provided by Conditional Access App Control.
★ When this WOULD be the correct answer
A company wants to automatically apply a 'Confidential' sensitivity label to files stored in a third-party cloud app (e.g., Box) that contain credit card numbers. They should configure Information Protection policies to scan and label files accordingly.
Why candidates choose this
Candidates may confuse the ability to apply sensitivity labels (Information Protection) with the ability to enforce access controls based on those labels, not realizing that Conditional Access App Control is needed for real-time session policies.
Analysis generated from the official SC-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Defender for Cloud Apps
Defender for Cloud Apps is a Microsoft cloud access security broker (CASB) that helps you discover, protect, and govern your cloud applications and data across multiple cloud environments.
Key term
Microsoft Defender
Microsoft Defender is a suite of security products that protects devices, data, and identities from cyber threats like malware, phishing, and unauthorized access.
About these practice questions
This SC-900 question is part of Courseiva's 1,250-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.