Microsoft Defender for Cloud Apps: CASB Capabilities for Cloud Discovery, Risk Assessment, and Data Control
A company wants to discover which cloud applications are being used by employees, assess the risk of those apps, and control data sharing in sanctioned apps like Box or Dropbox. Which Microsoft security solution should they implement?
Quick Answer
The answer is Microsoft Defender for Cloud Apps, the correct choice because it functions as a Cloud Access Security Broker (CASB) that delivers the three core capabilities described: cloud discovery to uncover shadow IT, risk assessment based on over 80 risk factors, and data control through data loss prevention (DLP) policies for sanctioned apps like Box or Dropbox. On the SC-900 exam, this question tests your understanding of how a CASB provides visibility, risk evaluation, and governance across cloud environments, often appearing as a scenario where you must match the solution to the need for both discovery and enforcement. A common trap is confusing Microsoft Defender for Cloud Apps with Microsoft Purview, but remember that Purview focuses on data governance and compliance, not real-time cloud app discovery and risk scoring. Memory tip: think “Discover, Assess, Control” as the three pillars of a CASB, and you will always pick Defender for Cloud Apps.
⚠ Common exam trap
Candidates often confuse the CASB functionality of Defender for Cloud Apps with the endpoint-focused or email-specific protections of other Defender products, leading candidates to pick Defender for Office 365 because it also controls data sharing, but only within Microsoft 365, not third-party apps like Box or Dropbox.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Defender for Cloud Apps
Microsoft Defender for Cloud Apps is a Cloud Access Security Broker (CASB) that provides visibility into shadow IT by discovering cloud app usage, assessing risk based on over 80 risk factors, and enforcing data loss prevention (DLP) policies to control data sharing in sanctioned apps like Box or Dropbox. It integrates with cloud providers via API connectors to monitor and govern data in real time.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Defender for Endpoint
Why it's wrong here
Defender for Endpoint protects endpoints (devices) from threats, but does not provide cloud app discovery or control over cloud app usage.
When this WOULD be correct
A company wants to protect its endpoints (e.g., laptops, servers) from malware, detect advanced threats, and provide incident response capabilities. Which Microsoft solution should they implement?
- ✓
Microsoft Defender for Cloud Apps
Why this is correct
Defender for Cloud Apps offers cloud app discovery (shadow IT), risk assessment, and the ability to apply DLP and governance policies to sanctioned and unsanctioned cloud apps.
- ✗
Microsoft Defender for Office 365
Why it's wrong here
Defender for Office 365 protects Exchange Online, SharePoint, and Teams from malicious threats like phishing and malware, but does not discover general cloud app usage.
When this WOULD be correct
This option would be correct if the question asked about protecting against email-based threats, such as phishing attacks, malware in attachments, or malicious links in Office 365, or securing SharePoint and OneDrive from malicious content.
- ✗
Microsoft Defender for Identity
Why it's wrong here
Defender for Identity monitors on-premises Active Directory for advanced threats (e.g., lateral movement), not cloud application discovery.
When this WOULD be correct
This option would be correct in a scenario where the company needs to protect on-premises identities from advanced threats like Pass-the-Hash, Kerberos Golden Ticket attacks, or suspicious lateral movement, especially in a hybrid environment with Active Directory.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SC-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Microsoft Defender for Cloud AppsCorrect answer▾
Why this is correct
Defender for Cloud Apps offers cloud app discovery (shadow IT), risk assessment, and the ability to apply DLP and governance policies to sanctioned and unsanctioned cloud apps.
✗Microsoft Defender for EndpointWrong answer — click to see why▾
Why this is wrong here
Microsoft Defender for Endpoint focuses on endpoint device protection (antivirus, threat detection, and response), not on discovering cloud app usage, assessing app risk, or controlling data sharing in sanctioned cloud apps like Box or Dropbox.
★ When this WOULD be the correct answer
A company wants to protect its endpoints (e.g., laptops, servers) from malware, detect advanced threats, and provide incident response capabilities. Which Microsoft solution should they implement?
Why candidates choose this
Candidates may confuse 'Defender' branding and assume all Defender products cover cloud app security, or they may think endpoint protection includes monitoring cloud app usage on devices.
✗Microsoft Defender for Office 365Wrong answer — click to see why▾
Why this is wrong here
Microsoft Defender for Office 365 focuses on protecting email and collaboration tools like Exchange, SharePoint, and Teams from threats such as phishing and malware, not on discovering and controlling cloud app usage or assessing app risk.
★ When this WOULD be the correct answer
This option would be correct if the question asked about protecting against email-based threats, such as phishing attacks, malware in attachments, or malicious links in Office 365, or securing SharePoint and OneDrive from malicious content.
Why candidates choose this
Candidates may confuse the cloud app discovery and data control capabilities of Defender for Cloud Apps with the Office 365 security features, assuming that Office 365 security covers all cloud app usage since Office 365 is a cloud suite.
✗Microsoft Defender for IdentityWrong answer — click to see why▾
Why this is wrong here
Microsoft Defender for Identity focuses on detecting and investigating advanced attacks on on-premises Active Directory, not on discovering or controlling cloud app usage or data sharing in sanctioned apps like Box or Dropbox.
★ When this WOULD be the correct answer
This option would be correct in a scenario where the company needs to protect on-premises identities from advanced threats like Pass-the-Hash, Kerberos Golden Ticket attacks, or suspicious lateral movement, especially in a hybrid environment with Active Directory.
Why candidates choose this
Candidates may confuse identity protection with cloud app security, assuming that securing identities automatically controls cloud app usage, or they may think Defender for Identity covers all Microsoft security solutions broadly.
Analysis generated from the official SC-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
DLP
Data Loss Prevention — security technology that detects and prevents unauthorised transmission of sensitive data outside an organisation.
Key term
Microsoft Defender
Microsoft Defender is a suite of security products that protects devices, data, and identities from cyber threats like malware, phishing, and unauthorized access.
About these practice questions
This SC-900 question is part of Courseiva's 1,250-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
8 more ways this is tested on SC-900
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A security team wants to discover all cloud applications being used by employees, including unsanctioned file sharing and collaboration apps. They plan to analyze traffic logs from their network firewall to identify usage patterns and assess each app's risk level. Which feature of Microsoft Defender for Cloud Apps should they enable?
medium- ✓ A.Cloud Discovery
- B.App Connectors
- C.Conditional Access App Control
- D.Information Protection
Why A: Cloud Discovery is the correct feature because it analyzes traffic logs from network firewalls and proxies to identify all cloud applications in use, including unsanctioned ones. It uses the Microsoft Defender for Cloud Apps catalog to assess each app's risk level based on factors like security posture, compliance certifications, and industry standards. This directly matches the scenario of discovering unsanctioned file sharing and collaboration apps from firewall logs.
Variation 2. A security team wants to discover which cloud applications are being used by employees, including unsanctioned file-sharing and collaboration apps. They plan to upload network traffic logs from their firewall to analyze app usage and risk levels. Which feature of Microsoft Defender for Cloud Apps should they enable?
medium- A.App Governance
- ✓ B.Cloud Discovery
- C.Conditional Access App Control
- D.Information Protection
Why B: Cloud Discovery is the correct feature because it analyzes network traffic logs (uploaded from firewalls or proxies) to identify which cloud applications are in use, including unsanctioned file-sharing and collaboration apps. It provides a risk score for each discovered app, enabling the security team to assess usage and enforce governance policies.
Variation 3. A company wants to gain visibility into the cloud applications that employees are using (e.g., unsanctioned SaaS apps), assess the risk level of each app based on multiple factors, and block access to high-risk applications. Which Microsoft security solution should they deploy?
medium- A.Microsoft Defender for Endpoint
- B.Microsoft Defender for Office 365
- ✓ C.Microsoft Defender for Cloud Apps
- D.Microsoft Sentinel
Why C: Microsoft Defender for Cloud Apps is a Cloud Access Security Broker (CASB) that provides visibility into cloud application usage, assesses risk based on factors like compliance, app store ratings, and security controls, and can block access to high-risk apps via reverse proxy or API integration. This directly matches the requirement to discover unsanctioned SaaS apps and enforce access controls.
Variation 4. A company wants to gain visibility into the use of unsanctioned cloud applications (shadow IT) within their organization. The security team has access to network proxy logs that show traffic to various cloud services. They want to use a Microsoft security solution to analyze these logs and identify which cloud apps are being used, by whom, and how much data is being consumed. Which capability of Microsoft Defender for Cloud Apps should they use?
hard- A.App governance
- ✓ B.Cloud Discovery
- C.Conditional Access App Control
- D.App Connectors
Why B: Cloud Discovery in Microsoft Defender for Cloud Apps analyzes network proxy logs (or traffic logs from firewalls and proxies) to identify unsanctioned cloud app usage (shadow IT). It provides visibility into which cloud apps are being used, by which users, and how much data is consumed, directly matching the company's requirement to analyze logs for shadow IT detection.
Variation 5. A company wants to gain visibility into which cloud applications are being used by employees (shadow IT) and assess the risk level of each app. They use Microsoft Defender for Cloud Apps. Which feature should they enable to discover and analyze these apps?
medium- A.App Governance
- ✓ B.Cloud Discovery
- C.Conditional Access App Control
- D.OAuth app policies
Why B: Cloud Discovery is the correct feature because it analyzes traffic logs against the Microsoft Defender for Cloud Apps catalog of over 31,000 cloud apps to identify shadow IT usage. It provides risk scores based on factors like security certifications, data encryption, and compliance standards, enabling the company to assess each app's risk level.
Variation 6. A security team wants to discover which cloud applications (such as Dropbox, Salesforce, or unsanctioned file-sharing apps) are being used by employees, even if those apps are not sanctioned by IT. They need to analyze usage patterns, risk levels, and identify potential shadow IT. Which feature of Microsoft Defender for Cloud Apps should they enable?
medium- A.App Connectors (API connectors)
- ✓ B.Cloud Discovery
- C.Conditional Access App Control
- D.Microsoft Defender for Endpoint
Why B: Cloud Discovery is the correct feature because it analyzes traffic logs from firewalls and proxies to identify cloud app usage, including unsanctioned apps like Dropbox or Salesforce, without requiring API integration. It provides risk scores, usage patterns, and shadow IT detection by comparing discovered apps against Microsoft's cloud app catalog of over 31,000 apps.
Variation 7. A large enterprise uses a variety of cloud applications, including sanctioned apps like Microsoft 365 and unsanctioned apps that employees adopted without IT approval. The security team wants to discover all cloud applications in use, assess each app's risk score based on more than 80 risk factors, and control data sharing within sanctioned apps to prevent data leakage. Additionally, they need to identify which users are using a new, unknown file-sharing service. Which Microsoft security solution should be deployed to meet these requirements?
hard- A.Microsoft Defender for Cloud
- ✓ B.Microsoft Defender for Cloud Apps
- C.Microsoft Defender for Endpoint
- D.Microsoft Purview Data Loss Prevention (DLP)
Why B: Microsoft Defender for Cloud Apps (formerly Microsoft Cloud App Security) is a Cloud Access Security Broker (CASB) that provides visibility into both sanctioned and unsanctioned cloud apps through its Cloud Discovery feature. It assesses risk scores based on over 80 risk factors (e.g., encryption standards, data residency, and compliance certifications) and enables data sharing controls via session policies (e.g., Conditional Access App Control) to prevent data leakage. It also supports anomaly detection to identify users of new, unknown file-sharing services by analyzing traffic logs from network appliances or endpoints.
Variation 8. A security team wants to discover all cloud apps being used by employees, including unsanctioned personal apps like unauthorized file-sharing services. They plan to analyze firewall logs to identify traffic patterns and assess each app's risk score. Which feature of Microsoft Defender for Cloud Apps should they enable?
medium- ✓ A.Cloud Discovery
- B.App Governance
- C.Information Protection
- D.Conditional Access App Control
Why A: Cloud Discovery is the correct feature because it analyzes traffic logs (e.g., from firewalls or proxies) to identify all cloud apps in use, including unsanctioned personal apps like unauthorized file-sharing services. It then assesses each app's risk score based on over 80 risk factors, such as encryption standards and data residency, enabling the security team to discover and evaluate shadow IT.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.