SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
Your organization is planning to deploy Microsoft Defender for Cloud Apps to discover shadow IT. You need to ensure that logs from your network proxy servers are ingested. Which method should you use to connect the logs?
⚠ Common exam trap
A common mistake on the SC-900 exam is confusing the App connector API (which connects to sanctioned cloud apps via their APIs for activity monitoring) with the Log collector (which ingests proxy logs for shadow IT discovery). Remember: Log collector is for log-based discovery of unsanctioned apps; App connector is for API-based monitoring of already-sanctioned apps.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Log collector
Microsoft Defender for Cloud Apps uses log collectors to ingest traffic logs from network proxy servers for shadow IT discovery. The log collector is a dedicated component that parses and uploads proxy logs (e.g., from Squid, Blue Coat, or Zscaler) to Defender for Cloud Apps for analysis. This method is specifically designed for log-based discovery of unsanctioned cloud app usage.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Log collector
Why this is correct
For Microsoft Defender for Cloud Apps to perform Shadow IT discovery, it requires network traffic logs from an organization's firewalls and proxies. A log collector is a lightweight agent deployed on-premises, typically on a dedicated server, that securely ingests these logs, parses them, and then forwards them to Defender for Cloud Apps. This process enables the service to analyze user activity, identify sanctioned and unsanctioned cloud applications, and assess their risk.
- ✗
Conditional Access App Control
Why it's wrong here
Conditional Access App Control (CAAC) is a real-time proxy that integrates with Azure AD Conditional Access policies to enforce granular session and access controls for cloud applications. While it provides powerful capabilities like preventing data exfiltration or enforcing read-only access, its primary function is policy enforcement during active user sessions, not the initial ingestion of network logs for comprehensive Shadow IT discovery. It operates *after* a user has authenticated, not as a mechanism for initial traffic analysis.
- ✗
Microsoft Sentinel data connector
Why it's wrong here
A Microsoft Sentinel data connector is designed to ingest security data from various sources into Microsoft Sentinel, which is a Security Information and Event Management (SIEM) and Security Orchestration, Automation, and Response (SOAR) solution. While Sentinel can certainly receive alerts and logs from Defender for Cloud Apps, its connectors are not the mechanism used by Defender for Cloud Apps itself to collect raw firewall or proxy logs directly from an organization's network for its Cloud Discovery capabilities.
- ✗
App connector API
Why it's wrong here
An App connector API in Defender for Cloud Apps establishes a direct, API-based connection to a specific cloud application (e.g., Office 365, Salesforce). This connection allows Defender for Cloud Apps to pull activity logs, user information, and file data directly from the application's backend for deeper visibility and control. However, these connectors are designed for direct integration with cloud services, not for collecting raw network traffic logs from on-premises firewalls or proxy servers for Shadow IT discovery.
Go deeper
Related to this question
Learn chapter
Microsoft Entra ID
Key term
Organization
An Organization is a top-level container in Google Cloud that represents your company or entities and serves as the root node for all your cloud resources, policies, and access control.
Key term
Microsoft Defender
Microsoft Defender is a suite of security products that protects devices, data, and identities from cyber threats like malware, phishing, and unauthorized access.
About these practice questions
This SC-900 question is part of Courseiva's 1,250-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.