SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
A security team wants to discover which cloud applications are being used by employees, including unsanctioned file-sharing and collaboration apps. They plan to upload network traffic logs from their firewall to analyze app usage and risk levels. Which feature of Microsoft Defender for Cloud Apps should they enable?
⚠ Common exam trap
A common mix-up: candidates confuse Cloud Discovery (which analyzes uploaded logs to find unsanctioned apps) with Conditional Access App Control (which enforces policies on already-discovered apps), leading them to pick Option C instead of B.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Cloud Discovery
Cloud Discovery is the correct feature because it analyzes network traffic logs (uploaded from firewalls or proxies) to identify which cloud applications are in use, including unsanctioned file-sharing and collaboration apps. It provides a risk score for each discovered app, enabling the security team to assess usage and enforce governance policies.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
App Governance
Why it's wrong here
App Governance within Microsoft 365 focuses on monitoring and managing the permissions and behavior of OAuth-enabled applications that have already been granted access to Microsoft 365 data. It helps detect and remediate risky or malicious app activity *after* an app is connected, such as over-privileged apps or unusual API calls. However, it does not perform initial discovery of unknown cloud services based on network traffic logs to identify shadow IT.
- ✓
Cloud Discovery
Why this is correct
Cloud Discovery is a core capability of Microsoft Defender for Cloud Apps that specifically ingests and analyzes network traffic logs from firewalls, proxies, or endpoint agents. Its primary purpose is to identify all cloud applications accessed by users in an organization, including unsanctioned 'shadow IT,' and to assess their associated risk scores. This process provides crucial visibility into an organization's entire cloud app landscape by revealing usage patterns and potential vulnerabilities.
- ✗
Conditional Access App Control
Why it's wrong here
Conditional Access App Control operates as a reverse proxy, providing real-time session monitoring and granular controls for *sanctioned* cloud applications *after* a user has authenticated via Azure AD Conditional Access. It enables policies like blocking downloads, requiring re-authentication, or auditing specific actions within a known, approved app. However, it does not discover unknown cloud applications or analyze raw network logs for initial shadow IT identification; it governs access to already-identified services.
- ✗
Information Protection
Why it's wrong here
Information Protection, encompassing services like Microsoft Purview Information Protection and Data Loss Prevention (DLP), is designed to classify, label, and protect sensitive data wherever it resides or travels. Its focus is on preventing data exfiltration and ensuring compliance by applying policies to sensitive content, such as credit card numbers or intellectual property. This capability is centered on data security and governance, not on identifying which cloud applications are being used across the network by analyzing traffic logs.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Risk score
A risk score is a numerical value that represents the level of risk associated with a given asset, threat, or vulnerability in a security context.
Key term
Governance
Governance is the framework of policies, processes, and controls that ensures IT activities align with business goals and comply with regulations.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.