SC-300 Certification Practice Question #215

Question

You have a Microsoft 365 E5 subscription that uses Microsoft Defender for Cloud Apps and Conditional Access policies.

You need to block access to cloud apps when a user is assessed as high risk.

Which type of policy should you create in the Microsoft Defender for Cloud Apps?

Accepted Answer

The requirement is to **block access** to cloud apps at sign-in based on user risk, which is the exact purpose of a Defender for Cloud Apps **access policy** — it monitors or blocks access to apps in real time (via Conditional Access App Control) based on risk factors such as user, device, and location. An activity policy (C) is not real-time and only acts on logged events, so it cannot block the access attempt itself; app discovery (A) is Cloud Discovery/Shadow-IT rating; an OAuth app policy (B) governs consented third-party app permissions, not user-risk-based access. MS Learn explicitly distinguishes access policies (block access) from session policies (control in-session activities), and the Suggested Answer is D, giving high confidence; the only reason it is not higher is the absence of any community votes on the page.

More SC-300 practice questions