SC-100 Certification Practice Question #114

Question

You have a Microsoft 365 subscription that uses Microsoft Defender XDR and Microsoft Purview.

On a Microsoft SharePoint Online site, you have a file named File1 that has a sensitivity label applied.

You need to recommend a solution that will reevaluate Conditional Access policies when a user downloads Filel from the SharePoint site.

What should you include in the recommendation?

Accepted Answer

The recommendation must reevaluate Conditional Access policies the moment a user downloads a labeled file from SharePoint Online. That real-time, in-session reevaluation is exactly what Microsoft Defender for Cloud Apps Conditional Access App Control provides: its "Require authentication context / step-up authentication" session control redirects the session back to Microsoft Entra Conditional Access for policy reevaluation when a sensitive activity (such as a file download filtered by sensitivity label) occurs. Defender for Cloud (CSPM for Azure resources), Defender for Office 365 (email/collaboration protection), and Entra application proxy (on-premises app publishing) cannot trigger Conditional Access reevaluation on a SharePoint download. The official Suggested Answer, a unanimous 4-vote community consensus, and a 2-👍 comment all select A, with MS Learn providing the decisive technical confirmation.

More SC-100 practice questions