SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
A security team wants to discover all cloud apps being used by employees, including unsanctioned personal apps like unauthorized file-sharing services. They plan to analyze firewall logs to identify traffic patterns and assess each app's risk score. Which feature of Microsoft Defender for Cloud Apps should they enable?
⚠ Common exam trap
Candidates often confuse Cloud Discovery with Conditional Access App Control, mistakenly thinking that real-time session policies can also discover unsanctioned apps, but discovery requires log analysis, not policy enforcement.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Cloud Discovery
Cloud Discovery is the correct feature because it analyzes traffic logs (e.g., from firewalls or proxies) to identify all cloud apps in use, including unsanctioned personal apps like unauthorized file-sharing services. It then assesses each app's risk score based on over 80 risk factors, such as encryption standards and data residency, enabling the security team to discover and evaluate shadow IT.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Cloud Discovery
Why this is correct
Cloud Discovery, a core capability within Microsoft Defender for Cloud Apps, is precisely designed to identify all cloud applications accessed by users within an organization. It achieves this by analyzing traffic logs from firewalls and proxies, providing comprehensive visibility into both sanctioned and unsanctioned "shadow IT" applications. This process generates detailed risk assessments for each discovered app, enabling security teams to understand potential vulnerabilities, compliance gaps, and usage patterns. Its primary function is comprehensive app discovery and risk assessment.
- ✗
App Governance
Why it's wrong here
App Governance, part of Microsoft Defender for Cloud Apps, is incorrect because its primary function is to monitor and manage OAuth-enabled applications that have been granted permissions to access data within Microsoft 365. It provides insights into app usage, data access, and potential policy violations for these specific types of applications. While crucial for securing the M365 ecosystem by controlling third-party app access, it does not perform broad discovery of all cloud applications used across an entire network.
- ✗
Information Protection
Why it's wrong here
Information Protection, encompassing services like Microsoft Purview Information Protection, is incorrect because its core purpose is to classify, label, and protect sensitive data across an organization. It focuses on applying policies for encryption, access restrictions, and data loss prevention (DLP) to ensure data confidentiality and integrity, regardless of where the data resides. This service is entirely centered on data lifecycle management and security, rather than identifying or cataloging cloud applications in use.
- ✗
Conditional Access App Control
Why it's wrong here
Conditional Access App Control, a component of Microsoft Defender for Cloud Apps, is incorrect because it functions as a real-time enforcement mechanism for access and session policies for cloud applications. It acts as a reverse proxy, intercepting user sessions to apply controls like preventing data downloads, enforcing multi-factor authentication, or blocking copy-paste actions. This feature *assumes* the applications are already known and configured; it does not possess any capability to discover new or unsanctioned cloud applications.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Microsoft Defender
Microsoft Defender is a suite of security products that protects devices, data, and identities from cyber threats like malware, phishing, and unauthorized access.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.