SC-900 Practice Question: Describe the concepts of security, compliance, and identity
Your organization uses Microsoft Defender for Cloud Apps. You need to discover shadow IT usage. Which feature should you enable?
⚠ Common exam trap
SC-900 often tests the difference between Cloud Discovery (find shadow IT) and Conditional Access App Control (govern sanctioned apps) — candidates pick the app catalog or file policies because they are Purview/Defender features, missing that discovery is the specific capability for shadow IT.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Cloud Discovery
Cloud Discovery in Microsoft Defender for Cloud Apps analyzes traffic logs from firewalls, proxies, and endpoints to identify which cloud apps are being used, including unsanctioned shadow IT. It builds a cloud app catalog with risk scores so security teams can sanction or block apps, directly addressing shadow IT discovery.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
File policies
Why it's wrong here
File policies scan content within connected apps for sensitive data and governance violations; they do not enumerate unsanctioned cloud services. It is tempting because file policies address data exposure, but discovering shadow IT requires Cloud Discovery, which analyses firewall and proxy logs to identify apps in use across the estate.
- ✗
Conditional Access App Control
Why it's wrong here
Conditional Access App Control enforces session policies on apps already integrated with Microsoft Entra ID; it cannot reveal unknown apps. It is tempting because it governs access to cloud apps, but shadow IT discovery needs Cloud Discovery, which parses traffic logs from firewalls and proxies to identify unsanctioned apps.
- ✓
Cloud Discovery
Why this is correct
Cloud Discovery analyses traffic logs from firewalls and proxies to identify unsanctioned cloud apps, directly satisfying the shadow IT discovery requirement. It builds an app catalogue with risk scores, letting you sanction or block usage. Other Defender for Cloud Apps features, such as app connectors or anomaly policies, govern known apps rather than reveal unknown ones.
- ✗
App catalog
Why it's wrong here
The app catalog lists sanctioned and known cloud apps for governance and risk scoring; it does not itself surface unsanctioned usage. It is tempting because the catalog underpins app governance, but discovering shadow IT requires Cloud Discovery, which analyses firewall and proxy traffic logs to identify apps in use.
Go deeper
Related to this question
Learn chapter
Defender Vulnerability Management Basics
Key term
Risk
Risk is the possibility that an event or action will negatively affect an organization's ability to achieve its goals, often measured in terms of likelihood and impact.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,279 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.