SC-900 Microsoft Defender for Cloud Apps 3

Question 1

How does Microsoft Defender for Cloud Apps integrate with Microsoft Sentinel?

Accepted Answer

Defender for Cloud Apps sends alerts and data to Sentinel for centralized SIEM analysis

Answer

Defender for Cloud Apps can stream alerts, activities, and discovery data to Microsoft Sentinel, enabling centralized investigation and correlation in the SIEM.

Question 2

Which Defender for Cloud Apps capability helps detect when a user account may have been compromised by analyzing impossible travel scenarios?

Accepted Answer

Anomaly Detection — Impossible Travel

Answer

The Impossible Travel anomaly detection policy identifies when a user logs in from two geographically distant locations within a timeframe that makes physical travel impossible, suggesting account compromise.

Question 3

What is the primary benefit of using Microsoft Defender for Cloud Apps 'Governance Actions'?

Accepted Answer

Automatically remediating policy violations in connected cloud apps without manual intervention

Answer

Governance Actions allow Defender for Cloud Apps to automatically remediate issues — such as revoking sharing permissions, quarantining files, or suspending users — when policies are triggered.

Question 4

Which of the following best describes the 'Session Policy' capability in Microsoft Defender for Cloud Apps?

Accepted Answer

Real-time controls that allow monitoring and restricting specific user activities during a cloud app session

Answer

Session Policies use Conditional Access App Control to provide real-time visibility and control over what users can do within a cloud app session, such as blocking downloads of sensitive files.

Question 5

In the context of Microsoft Defender for Cloud Apps, what does 'sanctioning' a cloud application mean?

Accepted Answer

Officially approving an app for use within the organization

Answer

Sanctioning a cloud app marks it as approved for organizational use in the Cloud App Catalog, which can also be used to configure firewall and proxy rules to allow its traffic.

SC-900 - Microsoft Certified: Security, Compliance, and Identity Fundamentals Certification Practice Test

SC-900 - Microsoft Certified: Security, Compliance, and Identity Fundamentals Certification Practice Test

SC-900 Microsoft Defender for Cloud Apps 3