SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
Which TWO of the following are capabilities of Microsoft Defender for Cloud Apps?
⚠ Common exam trap
Watch out — candidates often confuse Microsoft Defender for Cloud Apps with Microsoft Defender for Cloud (formerly Azure Security Center) or Microsoft Purview, leading them to select options like vulnerability assessment or information protection that belong to other services.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Session controls to monitor and control app access in real time
Microsoft Defender for Cloud Apps provides session controls that leverage reverse proxy architecture to monitor and control user app access in real time, enabling conditional access policies for cloud apps. Cloud discovery uses traffic logs from network appliances or Windows endpoints to identify shadow IT by analyzing app usage and risk scores.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Information protection for files in Microsoft 365
Why it's wrong here
Information protection for files, including classification, labeling, and encryption within Microsoft 365, is primarily a capability of Microsoft Purview Information Protection. While Microsoft Defender for Cloud Apps can detect and enforce policies based on Purview labels, it does not natively provide the core information protection mechanisms itself. Its role is more about monitoring and controlling access to cloud apps and data, not the intrinsic protection of the data content.
- ✓
Session controls to monitor and control app access in real time
Why this is correct
Session controls are a core capability of Microsoft Defender for Cloud Apps, functioning as a Cloud Access Security Broker (CASB). These controls enable real-time monitoring and intervention for user sessions accessing cloud applications, allowing organizations to enforce policies such as blocking downloads of sensitive data, requiring step-up authentication, or protecting uploads of unclassified files. This ensures data protection and compliance even when users are accessing apps from unmanaged devices.
- ✓
Cloud discovery to identify shadow IT
Why this is correct
Cloud discovery is a fundamental capability of Microsoft Defender for Cloud Apps designed to identify "shadow IT" within an organization. By analyzing traffic logs from firewalls and proxies, Defender for Cloud Apps discovers all cloud applications being accessed by users, assesses their risk levels, and provides insights into usage patterns. This helps security teams gain visibility into unsanctioned applications and mitigate potential risks associated with unmanaged cloud services.
- ✗
Identity governance and access reviews
Why it's wrong here
Identity governance, including access reviews, entitlement management, and privileged identity management, is a core feature set of Microsoft Entra ID (formerly Azure Active Directory). These capabilities focus on ensuring that users have appropriate access to resources over time, managing their lifecycle, and regularly verifying their permissions. Microsoft Defender for Cloud Apps, while integrating with Entra ID, does not directly provide these identity governance functions.
- ✗
Vulnerability assessment for Azure virtual machines
Why it's wrong here
Vulnerability assessment for Azure virtual machines is a key component of Microsoft Defender for Cloud, specifically within its Cloud Security Posture Management (CSPM) and Cloud Workload Protection Platform (CWPP) capabilities. Defender for Cloud scans VMs for known vulnerabilities, misconfigurations, and provides recommendations to strengthen their security posture. Microsoft Defender for Cloud Apps, in contrast, focuses on protecting cloud applications and data, not the underlying infrastructure like VMs.
Go deeper
Related to this question
Learn chapter
Microsoft Entra ID
Key term
Risk
Risk is the possibility that an event or action will negatively affect an organization's ability to achieve its goals, often measured in terms of likelihood and impact.
Key term
Proxy
A proxy is an intermediary server that sits between a client and a destination server, forwarding requests and responses while providing security, privacy, and control.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.