SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
A security team wants to discover all cloud applications being used by employees, including unsanctioned file sharing and collaboration apps. They plan to analyze traffic logs from their network firewall to identify usage patterns and assess each app's risk level. Which feature of Microsoft Defender for Cloud Apps should they enable?
⚠ Common exam trap
Many exam-takers confuse Cloud Discovery (passive log analysis for unsanctioned app discovery) with App Connectors (active API integration for sanctioned app monitoring), leading them to choose B because they think 'connecting to apps' is needed to discover them.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Cloud Discovery
Cloud Discovery is the correct feature because it analyzes traffic logs from network firewalls and proxies to identify all cloud applications in use, including unsanctioned ones. It uses the Microsoft Defender for Cloud Apps catalog to assess each app's risk level based on factors like security posture, compliance certifications, and industry standards. This directly matches the scenario of discovering unsanctioned file sharing and collaboration apps from firewall logs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Cloud Discovery
Why this is correct
Microsoft Defender for Cloud Apps' Cloud Discovery feature is specifically engineered to provide comprehensive visibility into all cloud applications accessed by users within an organization. It accomplishes this by ingesting and analyzing traffic logs from firewalls and proxy servers, extracting details about accessed URLs and IP addresses. This process enables the identification of both sanctioned and unsanctioned (shadow IT) cloud services, building a complete catalog of an organization's cloud app landscape and assessing associated risks.
- ✗
App Connectors
Why it's wrong here
App Connectors in Microsoft Defender for Cloud Apps facilitate deep, API-based integration with *sanctioned* cloud applications, such as Microsoft 365, Salesforce, or Box. This direct connection allows for enhanced security posture management, granular control over user activities, and advanced threat detection within those specific connected apps, including scanning files and monitoring user actions. However, App Connectors are not designed for the initial discovery of unknown or unsanctioned cloud applications across the network; they require prior knowledge of the application to establish a connection.
- ✗
Conditional Access App Control
Why it's wrong here
Conditional Access App Control (CAAC), powered by Microsoft Defender for Cloud Apps, functions as a reverse proxy to enforce real-time session policies for cloud applications. It intercepts traffic to apply granular controls over user actions, such as preventing data downloads or enforcing multi-factor authentication, *after* a user has been granted access through Azure AD Conditional Access. Its primary purpose is policy enforcement and session control for *known* applications, not the initial identification or cataloging of all cloud applications in use within an environment.
- ✗
Information Protection
Why it's wrong here
Microsoft Purview Information Protection (MPIP) is primarily focused on classifying, labeling, and protecting sensitive data throughout its lifecycle, whether at rest or in transit, across various environments. While it helps secure data within recognized applications by applying data loss prevention (DLP) policies, it does not possess the functionality to scan network traffic logs or analyze firewall data to discover and catalog unknown or unsanctioned cloud applications used by an organization. Its role is data governance and protection, not cloud application discovery.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Compliance
Compliance is the process of ensuring that an organization follows laws, regulations, standards, and internal policies that apply to its operations and data handling.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.