SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
Your company is deploying Microsoft Defender for Cloud Apps. You need to detect and block the use of unsanctioned cloud apps that exhibit risky behavior. Which feature should you configure?
⚠ Common exam trap
Watch out — candidates often confuse Conditional Access policies (which control access to known apps) with Cloud Discovery (which identifies and blocks unknown or unsanctioned apps), missing the core requirement of detecting risky behavior in previously unrecognized cloud services.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Cloud Discovery
Cloud Discovery is the correct feature because it analyzes traffic logs to identify unsanctioned cloud apps and assess their risk based on behavioral factors such as data upload volume, user count, and security posture. Once identified, Defender for Cloud Apps can automatically block these apps using the built-in app governance controls, enforcing policies to prevent risky app usage.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure Information Protection labels
Why it's wrong here
Azure Information Protection (AIP) labels are primarily used for classifying and protecting sensitive data within documents and emails, applying encryption, visual markings, and usage restrictions. They operate on the content itself, ensuring data remains protected regardless of where it travels. However, AIP labels do not provide capabilities for discovering or blocking access to cloud applications; their function is data-centric security.
- ✗
Conditional Access policies
Why it's wrong here
Conditional Access policies in Azure Active Directory (now Microsoft Entra ID) enforce access controls based on specific conditions like user identity, device compliance, location, and application. While they can restrict access to *sanctioned* applications under certain circumstances, they are not designed to discover unsanctioned cloud applications or block them at the network level. Their role is to govern access to known resources, not to identify or block unknown ones.
- ✓
Cloud Discovery
Why this is correct
Cloud Discovery, a core feature of Microsoft Defender for Cloud Apps, analyzes traffic logs from firewalls and proxy servers to identify all cloud applications accessed by users within an organization. It provides crucial visibility into 'shadow IT' by assessing the risk of discovered apps and can integrate with network security appliances to block access to unsanctioned or high-risk applications. This capability is fundamental for enforcing cloud app governance and reducing organizational risk.
- ✗
Data Loss Prevention (DLP) policies
Why it's wrong here
Data Loss Prevention (DLP) policies are designed to identify, monitor, and protect sensitive information from being shared inappropriately, either intentionally or unintentionally. These policies scan content for specific data types and enforce rules to prevent data exfiltration or misuse within applications. However, DLP policies do not discover which cloud applications are being used by employees, nor do they block access to the applications themselves; their focus is on the data content, not the application's existence or access.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Defender for Cloud
Microsoft Defender for Cloud is a cloud security posture management (CSPM) and cloud workload protection platform (CWPP) that provides unified security management and threat protection across hybrid and multi-cloud environments.
Key term
User
A user is any person, system, or device that interacts with an IT service, resource, or identity system, typically authenticated through credentials and authorized to perform specific actions.
About these practice questions
This SC-900 question is part of Courseiva's 1,250-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.