Describe the capabilities of Microsoft security solutions →mediumMultiple ChoiceObjective-mapped

SC-900 Practice Question: Describe the capabilities of Microsoft security solutions

Your organization recently deployed Microsoft Defender for Cloud Apps. You need to identify which users are using a personal Dropbox account to access corporate files. Which feature should you use?

⚠ Common exam trap

Many exam-takers confuse Cloud Discovery (which identifies unsanctioned app usage) with Activity policies (which monitor actions within already-sanctioned apps), leading them to choose A because they think monitoring user actions is sufficient to detect personal account use.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Cloud Discovery

B is correct because Cloud Discovery in Microsoft Defender for Cloud Apps analyzes traffic logs from your network to identify shadow IT usage, including users accessing personal Dropbox accounts from corporate devices. It uses anonymized data from Microsoft Intelligent Security Graph to detect unsanctioned cloud apps and map user activity, enabling you to pinpoint which users are bypassing corporate storage policies.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Activity policies
Why it's wrong here
Activity policies within Microsoft Defender for Cloud Apps (MDCA) are designed to monitor specific user actions and enforce real-time controls within *sanctioned* cloud applications. These policies are used for data governance, preventing data exfiltration, or blocking specific activities (e.g., downloads) based on contextual factors like user, device, or location. They require prior knowledge of the application to be configured and cannot discover unknown or unsanctioned cloud services.
✓
Cloud Discovery
Why this is correct
Cloud Discovery is a core capability of Microsoft Defender for Cloud Apps (MDCA) that analyzes traffic logs from firewalls and proxies to identify all cloud services accessed by users in an organization. It provides comprehensive visibility into shadow IT by detecting unsanctioned cloud applications, assessing their risk levels, and generating reports that help administrators understand usage patterns and potential security or compliance gaps.
✗
File policies
Why it's wrong here
File policies in Microsoft Defender for Cloud Apps (MDCA) are focused on data governance and protection for files stored within connected cloud applications. These policies are used to detect sensitive information, enforce data loss prevention (DLP) controls, apply classification labels, or manage sharing permissions on files. Their primary function is to protect data content and control its lifecycle, not to discover or identify which cloud applications are being utilized by users.
✗
App permissions
Why it's wrong here
App permissions, in the context of Microsoft Defender for Cloud Apps (MDCA), refer to the ability to review and manage OAuth applications that users have granted access to their Microsoft 365 data and other connected services. This feature allows administrators to identify potentially risky third-party applications, revoke their permissions, or ban them from the environment. It focuses on governing authorized application access rather than discovering new, unsanctioned cloud services or personal accounts.

Go deeper

SC-900 Practice Question: Describe the capabilities of Microsoft security solutions

Why each option matters

Option-by-option breakdown

Related to this question