SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
A security team wants to detect when a user downloads an unusually large number of files from a third-party cloud storage app (e.g., Box) after logging in from an unfamiliar location. They also want to automatically suspend the user's account if such behavior is detected. Which Microsoft security solution should they use?
⚠ Common exam trap
Candidates often confuse Microsoft Defender for Cloud Apps with Microsoft Defender for Office 365, assuming that 'cloud apps' only refers to Microsoft 365 services, but MDCA specifically covers third-party SaaS apps like Box, Salesforce, and AWS, while Defender for Office 365 is limited to Microsoft's own collaboration suite.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Defender for Cloud Apps
Microsoft Defender for Cloud Apps (MDCA) is the correct solution because it provides Cloud Access Security Broker (CASB) capabilities, including anomaly detection for user behavior across third-party cloud apps like Box. It can detect activities such as an unusually large number of file downloads from an unfamiliar location using its built-in behavioral analytics and then automatically apply a governance action, such as suspending the user's account, via policy-driven automated responses.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Defender for Office 365
Why it's wrong here
Microsoft Defender for Office 365 is specifically designed to protect an organization's Microsoft 365 services, including Exchange Online, SharePoint Online, Teams, and OneDrive for Business, from email-borne threats like phishing, malware, and business email compromise. While it secures data within these specific Microsoft services, it lacks the capability to monitor or detect user activities, such as file downloads, occurring within third-party cloud applications.
- ✓
Microsoft Defender for Cloud Apps
Why this is correct
Microsoft Defender for Cloud Apps functions as a Cloud Access Security Broker (CASB), providing comprehensive visibility, control, and protection across all cloud applications, both sanctioned and unsanctioned. It actively monitors user activities, including file downloads and uploads, across third-party SaaS applications, detecting anomalous behaviors like mass downloads that could indicate data exfiltration. This solution is specifically engineered to identify and respond to threats within the cloud app ecosystem, making it ideal for detecting when a user downloads a file from a cloud service.
- ✗
Microsoft Defender for Identity
Why it's wrong here
Microsoft Defender for Identity is primarily focused on protecting on-premises Active Directory and hybrid identity environments by monitoring domain controllers and AD FS servers for suspicious activities. It detects advanced threats like pass-the-hash, lateral movement, and privilege escalation using behavioral analytics of identity interactions. This solution does not directly monitor or provide visibility into user actions or data transfers occurring within cloud applications, making it unsuitable for detecting file downloads from such services.
- ✗
Microsoft Defender for Endpoint
Why it's wrong here
Microsoft Defender for Endpoint provides robust endpoint detection and response (EDR), vulnerability management, and next-generation protection for devices such as workstations, servers, and mobile devices. Its core function is to protect the endpoint itself from various threats and provide deep visibility into activities *on* the device. However, it does not directly monitor or log user activities, such as file downloads, that occur *within* the context of a cloud application service, especially when the application is accessed via a web browser and the activity doesn't directly involve the endpoint's file system in a detectable way for the cloud service itself.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Governance
Governance is the framework of policies, processes, and controls that ensures IT activities align with business goals and comply with regulations.
Key term
Defender for Cloud
Microsoft Defender for Cloud is a cloud security posture management (CSPM) and cloud workload protection platform (CWPP) that provides unified security management and threat protection across hybrid and multi-cloud environments.
About these practice questions
This SC-900 question is part of Courseiva's 1,250-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.