SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
Your company uses Microsoft Defender for Cloud Apps to discover shadow IT. The security team wants to automatically block the use of a newly discovered high-risk cloud app across all users. What is the most efficient approach?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create an app discovery policy with governance action to unsanction the app.
An app discovery policy with the governance action to unsanction the app automatically blocks the app across all users via the Defender for Cloud Apps API. Option A is incorrect because Conditional Access policies are identity-based and not designed to block specific cloud apps directly during discovery. Option B is incorrect because manually adding the app to the blocked list is not automatic and requires ongoing manual effort. Option D is incorrect because session controls monitor and control app usage in real time but do not permanently block the app.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a Conditional Access policy to block the app for all users.
Why it's wrong here
Creating a Conditional Access policy primarily controls access to applications at the authentication layer, determining who can sign in based on specific conditions. While it can block access to an app integrated with Azure AD, it does not inherently manage or block the usage of unsanctioned cloud apps discovered by Microsoft Defender for Cloud Apps that may not use Azure AD for authentication or are already in use. Its focus is on initial access, not continuous governance of shadow IT.
- ✗
Manually add the app to the blocked list in the cloud discovery settings.
Why it's wrong here
Manually adding an app to the blocked list in cloud discovery settings is a reactive, one-time administrative action. This approach lacks the automation and scalability required to continuously identify and address newly discovered unsanctioned applications as part of an ongoing shadow IT management strategy. It does not provide a proactive mechanism to automatically enforce security policies across the organization's cloud app landscape.
- ✓
Create an app discovery policy with governance action to unsanction the app.
Why this is correct
Creating an app discovery policy with a governance action to unsanction the app is the correct and most automated method. This policy allows Microsoft Defender for Cloud Apps to continuously scan discovered applications based on defined criteria (e.g., risk score, category, usage patterns). When an app matches the policy, the configured governance action, such as 'Unsanction app,' automatically marks it as unauthorized and triggers enforcement mechanisms, effectively blocking its use across the organization.
- ✗
Configure session controls to monitor app usage.
Why it's wrong here
Configuring session controls in Microsoft Defender for Cloud Apps is designed to monitor user activity within *sanctioned* cloud applications in real-time and apply granular controls during a session. These controls can prevent actions like downloading sensitive data or copying content, but they do not serve to block access to *unsanctioned* applications entirely. Their purpose is to govern behavior within an already accessed application, not to prevent initial access to unauthorized shadow IT.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Microsoft Defender
Microsoft Defender is a suite of security products that protects devices, data, and identities from cyber threats like malware, phishing, and unauthorized access.
Key term
Identity
Identity is the unique set of attributes that defines a user, device, or service in a computer system, determining what they can access and do.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.