SC-900 Practice Question: Describe the concepts of security, compliance, and identity
Your company uses Microsoft Defender for Cloud Apps. You notice that a user is downloading large volumes of data from a sanctioned cloud app that exceeds the normal pattern. Which action should you take to automatically block this activity?
⚠ Common exam trap
SC-900 often tests the difference between session policies (real-time control within sanctioned apps) and cloud discovery policies (visibility into unsanctioned apps), causing candidates to confuse monitoring with enforcement.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a session policy to monitor and control downloads
Microsoft Defender for Cloud Apps uses Conditional Access App Control to proxy user sessions to sanctioned cloud apps, enabling real-time monitoring and control. A session policy can detect anomalous download volumes and automatically block the download action within the session. This is the only option that provides real-time blocking of a specific activity (downloads) within a sanctioned app.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create a session policy to monitor and control downloads
Why this is correct
A session policy proxies the sanctioned app's traffic, letting Defender for Cloud Apps inspect and block download activity in real time. Creating one satisfies the requirement to automatically block the excessive downloading rather than merely alerting on it.
- ✗
Configure a cloud discovery policy
Why it's wrong here
Cloud discovery policies classify unsanctioned apps from traffic logs and can sanction or block entire apps, but they cannot act on a user's download volume within a sanctioned app. They are correct when cataloguing shadow IT usage across your estate.
- ✗
Create a Microsoft Purview DLP policy
Why it's wrong here
Purview DLP policies inspect and block sensitive content moving through locations such as Exchange, SharePoint and endpoints, not anomalous download volumes in a sanctioned cloud app. It is correct when preventing credit card numbers or personal data leaving your tenant.
- ✗
Block the app in Defender for Cloud Apps
Why it's wrong here
Blocking the app removes access for every user, including legitimate business use, and does not target the individual's abnormal download behaviour. It is correct when an app is confirmed unsanctioned and should be prohibited organisation-wide.
Go deeper
Related to this question
Learn chapter
Cloud Security Posture Management (CSPM)
Key term
Defender for Cloud
Microsoft Defender for Cloud is a cloud security posture management (CSPM) and cloud workload protection platform (CWPP) that provides unified security management and threat protection across hybrid and multi-cloud environments.
Key term
User
A user is any person, system, or device that interacts with an IT service, resource, or identity system, typically authenticated through credentials and authorized to perform specific actions.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,279 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.