SC-100 Certification Practice Question #252

Question

You have an Azure subscription and a Microsoft 365 subscription.

Your company uses several software as a service (SaaS) applications.

To align with Microsoft cloud security benchmark (MCSB) and Microsoft Cybersecurity Reference Architectures (MCRA), you plan to design a solution to provide visibility into user activity across the applications and detect potentially risky behavior in real time.

Which service should you recommend?

Accepted Answer

The requirement is visibility into user activity across multiple SaaS applications plus real-time detection of risky behavior, aligned to MCSB and MCRA. Microsoft Defender for Cloud Apps is the CASB layer that, per MS Learn, monitors user activities across SaaS apps and detects unusual or risky behavior in real time (UEBA/anomaly detection such as impossible travel, mass download, ransomware). Purview Information Protection handles data classification, Sentinel is the SIEM/SOAR layer, and Defender for Endpoint covers device/endpoint protection — none provide the SaaS user-activity visibility this question asks for. Suggested Answer, Most Voted, and MS Learn all agree on A; confidence is 90% (Most Voted has only 2 votes, but the documentation alignment is unambiguous).

More SC-100 practice questions