Task 3.4: Manage and monitor app access by using Microsoft Defender for Cloud Apps

• ATurn on the Microsoft Defender for Endpoint integration in Defender for Cloud Apps

  Correct

  Discovery then uses the network transaction logs that Defender for Endpoint collects on each device, wherever it is.

• BRoute the laptops' app sessions through Conditional Access App Control from every location

  Incorrect

  App control proxies sessions of apps that sign in through Microsoft Entra ID; it doesn't discover the other cloud apps the laptops reach.

• CUpload a snapshot report from the firewall each week

  Incorrect

  Snapshot reports come from the same firewall logs that miss home traffic.

• DConnect Microsoft 365 with an app connector

  Incorrect

  App connectors give activity in a connected app; they don't discover other cloud apps in use.

The Defender for Endpoint integration feeds the network transaction logs collected on onboarded Windows devices into cloud discovery, so shadow IT is discovered even off the corporate network. Reports built from the corporate firewall's logs can't see traffic that never passes it.

• ACloud discovery data anonymization for the uploaded logs and continuous reports

  Correct

  User names are replaced with encrypted values, and admins can resolve one when needed, with each lookup audited.

• BRemoving the user name column from the firewall logs before each upload

  Incorrect

  Without user data, investigators couldn't resolve a user even when an investigation allows it.

• CSecurity Reader as the only Defender for Cloud Apps role for the security team

  Incorrect

  Roles change what admins can do, not whether discovery data shows real names.

• DSnapshot reports instead of continuous reports

  Incorrect

  Snapshot and continuous reports both show real user names unless anonymization is selected for them.

With anonymization, uploaded discovery logs are sanitized and user names are replaced with encrypted values (AES-128 with a per-tenant key). Admins can resolve a specific encrypted user name for an investigation, and each conversion is recorded in the governance log.

• AA session policy that blocks downloads on unmanaged devices

  Incorrect

  Session policies act inside browser sessions; they don't block the native apps from signing in.

• BAn app connector for Salesforce that suspends users of the mobile and desktop apps on unmanaged devices

  Incorrect

  Connector governance acts on accounts after the fact; it can't decide access per device at sign-in.

• CAn access policy that blocks mobile and desktop apps on devices lacking a compliant tag

  Correct

  Access policies filter on client app type and device tags and can block those sign-ins.

• DA cloud discovery policy that marks Salesforce as unsanctioned

  Incorrect

  Unsanctioning governs the whole app for every user and device, so it can't keep browser access while blocking only the native clients.

Defender for Cloud Apps access policies apply at sign-in to apps routed through Conditional Access App Control, with filters such as Client app (browser or mobile and desktop) and Device tags (for example Intune compliant or hybrid joined). Blocking mobile and desktop clients from untagged devices leaves browser access in place.

• AUnsanctioned

  Incorrect

  Unsanctioned apps are blocked on the devices, with no option to continue.

• BSanctioned

  Incorrect

  Sanctioned marks an app as approved, so users get no warning.

• CMonitored

  Correct

  Monitored apps trigger a warning that users can bypass for a set duration, with a custom redirect link.

• DA custom app tag named Warn

  Incorrect

  Only the built-in Monitored and Unsanctioned tags are synced to Defender for Endpoint; a custom tag doesn't make devices show a warning.

With the Defender for Endpoint integration and Enforce app access, apps tagged Unsanctioned are blocked on devices, while apps tagged Monitored show a warning that users can bypass. Admins can set a custom redirect URL for the warning and how long a bypass lasts.

• AStop the user from signing in to the app before any session starts

  Incorrect

  A session policy acts on activities after the session is allowed.

• BApply its controls only to Microsoft 365 apps

  Incorrect

  Session policies apply to apps routed through Conditional Access App Control.

• CMonitor or block activities such as file downloads during the session

  Correct

  Session policies control what happens inside a session in real time.

• DEvaluate cloud discovery logs after the session has ended

  Incorrect

  Session policies act in real time, not on discovery logs.

Session policies let a user into the app while Defender for Cloud Apps monitors the session in real time and can limit activities such as downloads, uploads, copying or printing.

• AA daily summary of the sessions routed through Conditional Access App Control

  Incorrect

  App control sessions are monitored and logged as activities, not as discovery reports.

• BA report of OAuth app permissions granted in Microsoft 365

  Incorrect

  OAuth apps are managed separately, not through discovery reports.

• CA list of activities from apps connected through API connectors in the portal

  Incorrect

  API connectors feed the activity log, not snapshot reports.

• DA one-time analysis of firewall or proxy logs that you upload manually

  Correct

  Snapshot reports give visibility from logs you upload by hand.

Snapshot reports give a one-time view of cloud app use from traffic logs that you export from firewalls and proxies and upload manually.

• AA session policy with a download filter

  Incorrect

  Session policies act on sessions in apps routed through App Control.

• BAn app discovery policy with those filters and an email alert

  Correct

  Discovery policies alert you when newly detected apps match their filters.

• CAn OAuth app policy filtered on permission level

  Incorrect

  OAuth app policies cover apps granted access through OAuth.

• DAn access policy that blocks the category

  Incorrect

  Access policies apply at sign-in to routed apps; they don't alert on discovered apps.

App discovery policies in Defender for Cloud Apps alert you when new apps are detected that match filters such as category, risk score and number of users, with a daily alert limit and email notifications.