Question 820 Security wants an alert when a file becomes publicly accessible, not simply inventory all files currently shared. Which approach is appropriate? Add an antivirus exclusion to all laptops instead of assessing the cloud application policy condition that blocked the workflow A Teams usage report only A static file inventory alone always detects the moment of change Consider an activity policy on the sharing change with supported event data Explanation Correct Answer D:Event policies can target the action that exposed the file. Incorrect Answers A:Antivirus file exclusions do not modify Cloud Apps access or session governance conditions for the sanctioned app. B:Usage aggregates do not identify the sharing operation. C:State views may not provide event timing.
Question 821 A file policy finds sensitive information publicly shared in a connected cloud app. Which automated action may be appropriate where supported? Delete the entire tenant without analysis Disable all audit records after detection Only update a global Secure Score target Remove public collaboration permissions or quarantine the file under an approved policy Explanation Correct Answer D:Governance actions can remediate risky content exposure. Incorrect Answers A:Tenant deletion is disproportionate. B:Removing evidence harms investigation. C:A metric change does not remove public access.
Question 822 A user signs in successfully then attempts to download a sensitive report from an unmanaged browser. Which control can monitor or restrict the session? Only authentication methods registration campaign Only an Exchange transport rule Conditional Access app control with Defender for Cloud Apps for supported apps Only a device update ring setting Explanation Correct Answer C:Session policies can act after authentication on cloud actions. Incorrect Answers A:Enrollment does not inspect each download. B:SMTP cannot intercept SaaS browser downloads. D:Servicing does not directly restrict file downloads.
Question 823 A SaaS app uses a nonstandard client that does not behave correctly with session control proxying. What should the engineer verify? Application/client compatibility with Conditional Access app control and supported deployment methods Proxy every native connection regardless of its supported authentication flow Apply a file-classification rule without verifying the application protocol Assume conditional access browser controls cover all clients after a successful user sign-in Explanation Correct Answer A:Not every client can be proxied identically. Incorrect Answers B:A nonbrowser client may fail or bypass session controls when the flow is unsupported. C:Content conditions cannot repair unsupported application proxy behavior. D:An authentication grant does not prove a nonstandard native client supports session-control interception.
Question 824 A cloud file operation appears under an application service principal rather than a named employee. What should investigators examine? Treat the event as impossible because no user appears Assign the event automatically to the last human login Only examine Exchange message trace App-only identity, permissions and workload activity context Explanation Correct Answer D:Applications may perform actions without an interactive user. Incorrect Answers A:Service principals are valid actors. B:A last login does not prove ownership of the API action. C:Mail trace may not identify the cloud app action.
Question 825 An approved cloud storage provider discloses a significant security incident. What should the governance team do? Reassess provider risk, data exposure and sanctioned status using current evidence Delete all logs about vendor use Assume every customer file was compromised Keep the previous approval forever without review Explanation Correct Answer A:Prior approval must be revisited after material changes. Incorrect Answers B:Logs help assess exposure. C:Scope must be established from evidence. D:Risk can change over time.
Question 826 A firewall log contains only shared NAT source IP, and Cloud Discovery cannot identify individuals. What is the likely limitation? Every NAT IP always represents one employee Only an Exchange alias can resolve firewall user mapping A different color in the dashboard identifies the user Network logs may lack per-user mapping without supplementary identity context Explanation Correct Answer D:NAT addresses are not unique user identities. Incorrect Answers A:Shared egress hides multiple devices. B:Email aliases are not in every network log. C:Visual styling is not identity attribution.
Question 827 A connected app asks for broad API permissions beyond the original approved monitoring scope. What should admins do? Approve all scopes automatically to avoid missing events Reuse a Global Administrator account as a permanent API credential Hide the permission request in reports Review least-privilege requirements and consent before expanding connector access Explanation Correct Answer D:Excessive scopes create security exposure. Incorrect Answers A:Unneeded privileges increase risk. B:Human privileged accounts are inappropriate integration secrets. C:Concealment does not limit access.
Question 828 A user downloads files from one country immediately after a sign-in from another. Which investigation is appropriate? Ignore the event because MFA succeeded Conclude physical travel is impossible from IP alone Only review a SharePoint library title Correlate activity IP, sign-in session, VPN context and device evidence Explanation Correct Answer D:App activity and identity telemetry can reveal compromise. Incorrect Answers A:MFA does not guarantee the session was legitimate. B:Proxies and VPNs can affect geography. C:Titles do not identify session origins.
Question 829 A sanctioned CRM shows a sudden drop in observed traffic after proxy migration, but users report normal activity. What should be assessed? Traffic collection coverage and new egress paths before interpreting the drop as lower use Treat the application's unchanged sanctioned tag as proof that the migrated proxy still submits its traffic logs The app's vendor risk rating necessarily improved The service must have lost all users Explanation Correct Answer A:Logging changes can distort discovery metrics. Incorrect Answers B:Sanction status is a governance classification, not evidence that a new proxy forwards supported telemetry for Cloud Discovery. C:Use volume does not determine rating. D:Unobserved traffic may still occur.
Question 830 An approved cloud app now contains a newly installed extension requesting broad file access. What should reviewers assess? Trust the approved application's extension because messages from its publisher have low phishing scores, without evaluating its OAuth grants The approved app automatically makes every extension safe Only changing the extension's name removes its access Extension consent, scopes, actor and observed API activity separately from base app sanctioning Explanation Correct Answer D:Approval of a platform does not authorize every plugin. Incorrect Answers A:Sender reputation says little about newly requested file API scopes; extensions need separate consent and activity assessment. B:Third-party extensions can introduce risk. C:Renaming does not revoke OAuth grants.
