SC-300 Certification Practice Question #191

Question

You have a Microsoft 365 E5 subscription that uses Microsoft Defender for Cloud Apps and Conditional Access policies.

You need to block access to cloud apps when a user is assessed as high risk.

Which type of policy should you create in the Microsoft Defender for Cloud Apps portal?

Accepted Answer

The requirement is to block real-time access to cloud apps when a user is assessed as high risk, in a tenant that already uses Defender for Cloud Apps with Conditional Access. MS Learn states that Defender for Cloud Apps access policies (built on Conditional Access app control) provide real-time access control that can block access based on risk factors including user risk surfaced from Identity Protection. The Suggested Answer, a 10-vote community consensus, and a 4-👍 comment citing the official access-policy doc all converge on A. Anomaly detection (C) only detects and reports anomalous activity and cannot directly enforce a real-time block tied to user-risk level, so it is eliminated.

More SC-300 practice questions