Question 840 The proxy feeds Cloud Discovery but reports every session under the gateway appliance rather than its actual employee. What data attribute is most directly missing? Authenticated source-user identity or a reliable proxy-to-user mapping in the uploaded logs A global Cloud Apps sanction decision for the proxy server An additional file sensitivity label in SharePoint An Exchange Online accepted-domain configuration Explanation Correct Answer A:A shared gateway address cannot by itself attribute events to individuals. Incorrect Answers B:Sanctioning is not a replacement for log identity information. C:Content classification does not identify the web request actor. D:Mail recipient domains do not supply proxy user attribution.
Question 841 Cloud Discovery indicates 50 GB sent to an unapproved cloud storage service in a day. What conclusion is defensible without examining the underlying transfers? The observed upload volume warrants investigation, but traffic alone does not prove confidential data exfiltration Every transferred byte is confirmed to be a customer secret The volume proves that an attacker has administrative privileges The destination is harmless if a single employee approved it Explanation Correct Answer A:The report measures traffic rather than definitive content sensitivity or intent. Incorrect Answers B:Traffic accounting does not expose the classification of all uploaded data. C:High upload volume does not establish privilege level. D:One person's consent does not replace the organizational risk decision.
Question 842 A discovery administrator wants to remove known synthetic monitoring traffic from reports without hiding employees using the same cloud app. How should collection be adjusted? Disable monitoring of every HTTPS destination Apply a narrowly scoped exclusion based on the synthetic source or identity, then validate remaining observations Exclude all traffic during working hours regardless of source Exclude the entire application's domain for all users Explanation Correct Answer B:Targeted exclusion avoids erasing legitimate activity from real users. Incorrect Answers A:That removes discovery visibility across services. C:A time-only exclusion discards normal business usage. D:A blanket app exclusion would hide real employee adoption.
Question 843 A file policy detects public links to a classified document in a supported connected app. The owner wants containment without deleting the file itself. Which action best fits when supported? Reclassify the app as sanctioned without altering file permissions Delete the entire cloud app connector to remove its sharing links Set the corporate mail sender-policy record to block external file-sharing recipients of the cloud application Remove public sharing or quarantine the file using a supported, approved governance action Explanation Correct Answer D:The response reduces external exposure while preserving data when supported by that app. Incorrect Answers A:App approval does not remove exposure on existing files. B:A connector deletion does not revoke already established file links. C:SPF applies to outgoing email sender authorization, not cloud app file-sharing and guest permission enforcement.
Question 844 A Cloud Apps file policy is about to revoke links on 40,000 files, including legal collaboration sites. What is the most relevant pre-enforcement validation? Replace every sensitivity label with an unlabeled state first Run the policy in a non-disruptive mode, inspect actual matched files, and obtain business exceptions Enable remediation and inspect results only after every link is removed Change the warning banner color so administrators notice the rule Explanation Correct Answer B:Large-scale governance actions should be scoped against real content before mass remediation. Incorrect Answers A:Removing classification worsens context rather than validating sharing scope. C:Irreversible operational impact may already have occurred. D:Visual styling does not establish whether the match set is safe.
Question 845 Security wants to stop a user from copying text within a monitored browser session, not simply alert on a stored file's classification. Which control family should be investigated? A periodic cloud file inventory policy alone A Microsoft 365 group naming policy Supported Defender for Cloud Apps session controls under Conditional Access App Control An Exchange inbound connector scope setting Explanation Correct Answer C:Session governance can inspect or restrict supported in-session actions. Incorrect Answers A:Inventory-based policies may not control a live browser interaction. B:Group naming does not govern copying from a cloud app session. D:Mail transport does not restrict browser clipboard operations.
Question 846 A Conditional Access rule is enabled for a SaaS app, but browser traffic never routes through Defender for Cloud Apps session controls. What should the administrator verify? The Conditional Access session-control selection, user/app targeting, and app support prerequisites Whether the app vendor has a high Discovery risk score Whether the tenant's Exchange transport rule priority is zero Validate only OAuth application consent while ignoring Conditional Access session control routing Explanation Correct Answer A:Sign-in policy and Cloud Apps session integration must be configured for the intended app and users. Incorrect Answers B:A risk score alone does not activate proxy session controls. C:Transport rule ordering does not redirect the SaaS browser session. D:App consent is different from proxy-backed session control configuration and does not establish whether targeted browser sessions are routed.
Question 847 A company uses a desktop synchronization client and assumes a browser-only session control will restrict all its file transfers. What should the team verify? Whether a Cloud Discovery report uses a weekly rather than monthly graph Check the user's Entra sign-in name but not the native client application's route through supported session controls Whether the client flow is supported by the chosen session control and whether separate access restrictions are required Assume an endpoint web-block policy provides the same in-session inspection of desktop sync traffic Explanation Correct Answer C:Nonbrowser protocols can bypass assumptions made for browser session actions. Incorrect Answers A:Reporting intervals do not enforce client controls. B:Identity naming may be valid while an unsupported desktop client bypasses browser-based session inspection. D:Web protection and reverse-proxy browser-session inspection have different supported flows and enforcement mechanisms.
Question 848 An app is marked unsanctioned in Cloud Discovery, yet staff can still open it in a browser. Which missing implementation most plausibly explains this? No supported blocking integration or network/endpoint enforcement has been applied for the app The app has too many downloads for a risk report A Purview label policy was not published for Exchange mail The tenant's default custom domain does not use the app vendor name Explanation Correct Answer A:Marking an app unsanctioned is a governance label, not universal enforcement across every access path. Incorrect Answers B:Volume does not determine whether blocking integration is enabled. C:Mail labels do not enforce all cloud app access decisions. D:Domain branding cannot enforce app sanction choices.
Question 849 Defender for Cloud Apps tags an app unsanctioned and Defender for Endpoint integration is enabled, but one machine still accesses the app. Which device fact should be investigated? Whether the device is assigned a Microsoft 365 group display name Whether that device is onboarded and receiving the relevant web protection/enforcement policy Check only the user's Cloud Apps license without inspecting the endpoint policy on this device Whether its user has a mailbox retention label Explanation Correct Answer B:An unenrolled or noncompliant endpoint may not enforce the integrated block. Incorrect Answers A:Group display names do not establish endpoint web enforcement. C:Licensing can be a prerequisite, but an individual device's continued access calls for checking onboarding and enforcement delivery. D:Retention has no bearing on browser app blocking by the endpoint agent.
Question 850 A service principal has newly granted application permissions to read files across sites, and users did not initiate corresponding downloads. Which evidence is most important? Review admin consent records, granted Graph scopes, app identity, and subsequent API access Inspect only the app's friendly publisher name in the consent prompt and assume all tenant-wide Graph permissions were justified Look only for repeated browser downloads in a single employee session Assume the app is safe because it has existed for two years Explanation Correct Answer A:Application permissions can allow noninteractive access independent of an individual user's browser activity. Incorrect Answers B:Publisher identity alone does not establish who granted broad application permissions or how the token was used. C:Noninteractive API calls may not appear as user browser downloads. D:App age does not establish that a new grant is justified.
