SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
Your organization uses Microsoft Defender for Cloud Apps. You need to detect anomalous user behavior such as impossible travel. Which type of policy should you configure?
⚠ Common exam trap
Microsoft often tests the distinction between rule-based policies (Activity policies) and machine-learning-based anomaly detection, leading candidates to choose Activity policy because they think they can manually define 'impossible travel' rules, but in practice, anomaly detection is the only automated way to handle such dynamic behavioral patterns.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Anomaly detection policy
Anomaly detection policies in Microsoft Defender for Cloud Apps use machine learning and behavioral analytics to establish a baseline of normal user activity and then flag deviations such as impossible travel (e.g., a user logging in from New York and then from London within an unrealistic time frame). This policy type is specifically designed to detect suspicious patterns like credential theft or account compromise without requiring predefined rules.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Anomaly detection policy
Why this is correct
Microsoft Defender for Cloud Apps' anomaly detection policies leverage machine learning and User Behavior Analytics (UBA) to identify unusual activities that deviate from a user's learned baseline. These policies are specifically designed to detect sophisticated threats like impossible travel, where a user logs in from geographically distant locations in an impossibly short timeframe, or unusual login locations, failed logins, and suspicious activities, by continuously monitoring and analyzing user and entity behavior.
- ✗
Activity policy
Why it's wrong here
Activity policies in Microsoft Defender for Cloud Apps are designed to enforce specific actions or alerts based on discrete, predefined activities performed by users within connected cloud applications. Unlike anomaly detection, they operate on a rule-based logic, triggering when a specific event (e.g., file download, admin login) occurs, rather than identifying deviations from a behavioral baseline or complex patterns like impossible travel.
- ✗
App discovery policy
Why it's wrong here
App discovery policies in Microsoft Defender for Cloud Apps are primarily used to identify and categorize all cloud applications being accessed by users within an organization's network, including sanctioned and unsanctioned (shadow IT) apps. Their purpose is to provide visibility into cloud app usage and assess risk, not to monitor individual user behavior for anomalies such as impossible travel.
- ✗
Session policy
Why it's wrong here
Session policies in Microsoft Defender for Cloud Apps provide real-time, granular control over user sessions within cloud applications, allowing actions like blocking downloads, requiring step-up authentication, or monitoring activities based on predefined conditions and risk levels. While they can prevent risky actions during a session, their primary function is not to detect behavioral anomalies like impossible travel, but rather to enforce access controls and monitor ongoing sessions.
Go deeper
Related to this question
Learn chapter
Microsoft Entra ID
Key term
Baseline
A baseline is a documented starting point for the normal performance and behavior of a system, network, or component, used to detect changes and troubleshoot issues.
Key term
Policy
A policy is a set of rules or guidelines that defines how an organization manages, secures, and operates its IT systems and services.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.