SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
Your company uses Microsoft Defender for Cloud Apps. You want to discover which cloud apps are being used in your organization and assess their risk levels. What should you use?
⚠ Common exam trap
It's easy for candidates to confuse the Cloud App Security Catalog (a static risk database) with Cloud Discovery (the active monitoring and log analysis feature), leading candidates to pick A when they need the tool that actually discovers in-use apps.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Cloud Discovery
Cloud Discovery is the feature within Microsoft Defender for Cloud Apps that analyzes traffic logs to identify which cloud apps are being used in your organization and assesses their risk based on the Cloud App Security Catalog. It provides visibility into Shadow IT by discovering unsanctioned app usage and assigning a risk score to each app.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Cloud App Security Catalog
Why it's wrong here
The 'Cloud App Security Catalog' is not a dedicated feature for discovering cloud app usage from network traffic logs within Microsoft Defender for Cloud Apps. While Defender for Cloud Apps maintains an extensive catalog of over 31,000 cloud applications, this catalog primarily serves to provide risk assessments for known applications and to facilitate policy enforcement, such as Conditional Access App Control for sanctioned apps. It does not actively scan network logs to identify new or unsanctioned applications.
- ✓
Cloud Discovery
Why this is correct
Cloud Discovery is the precise capability within Microsoft Defender for Cloud Apps designed to identify and analyze all cloud applications accessed by users across an organization's network. It functions by ingesting and analyzing traffic logs from various sources, including firewalls, proxies, and endpoint agents, to detect accessed URLs, IP addresses, and user agents. This process effectively uncovers shadow IT, assesses the inherent risk of discovered applications, and provides comprehensive insights into their usage patterns.
- ✗
Microsoft Purview Data Map
Why it's wrong here
Microsoft Purview Data Map is a foundational service within the Microsoft Purview governance solution, primarily focused on building a holistic, up-to-date map of an organization's data estate. Its core function involves automatically scanning, classifying, and cataloging data assets across hybrid and multi-cloud environments to enable data governance, lineage tracking, and data discovery. It is specifically designed for understanding data assets and their relationships, not for monitoring network traffic to identify the usage of cloud applications.
- ✗
Microsoft Intune app inventory
Why it's wrong here
Microsoft Intune's app inventory feature provides visibility into applications installed and managed on enrolled devices, serving as a component of mobile device management (MDM) and mobile application management (MAM). It reports on applications that Intune has deployed or detected on managed endpoints, primarily for compliance and software asset management on those specific devices. This capability is not designed to analyze network traffic logs to discover the broader usage of unmanaged, unsanctioned, or shadow IT cloud applications across an entire corporate network.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Organization
An Organization is a top-level container in Google Cloud that represents your company or entities and serves as the root node for all your cloud resources, policies, and access control.
Key term
Risk score
A risk score is a numerical value that represents the level of risk associated with a given asset, threat, or vulnerability in a security context.
About these practice questions
This SC-900 question is part of Courseiva's 1,250-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.