A multinational company has offices in the US and EU. They want to use Cloud App Discovery to identify shadow IT, but they are concerned about data residency and want to minimize the amount of data sent to the Defender for Cloud Apps backend. Which deployment approach should they use?

Deploy a single log collector in the US and have all traffic routed through it.

Disable Cloud App Discovery and rely on manual reporting from employees.

Deploy the log collector in each office and configure it to send data to the nearest Defender for Cloud Apps regional endpoint, if available.

Use the native Cloud App Discovery agent on each user's device instead of log collectors.

A company wants to discover which cloud apps are being used by employees. They have deployed the Defender for Cloud Apps collector on their domain-joined Windows workstations. After two weeks, the Cloud App Discovery dashboard shows very low traffic. The security team suspects that some employees use non-domain-joined laptops. What should they do to improve visibility?

Enable Cloud App Discovery in Microsoft 365 Defender and wait for automatic discovery

Use the activity log to manually identify unknown apps

Deploy the collector to the non-domain-joined laptops as well

Configure the collector to use a different port for log forwarding

A company has deployed the Defender for Cloud Apps collector on a server that receives logs from their Cisco ASA firewall. The Cloud App Discovery report shows only a small percentage of expected traffic. The administrator suspects that some traffic is not being logged by the firewall. What should the administrator do to improve discovery coverage?

Enable the app connector for Microsoft 365

Install the collector on every client computer

Increase the collector's log upload frequency

Configure the firewall to log all traffic, including allowed connections

A company wants to control access to Microsoft 365 apps based on the user's location. They have connected Microsoft 365 to Defender for Cloud Apps. They want to block access from countries that are not in the allowed list. What should they configure?

An access policy with a condition for 'Location' and set the action to 'Block'

An activity policy with a condition for 'Location' and set the action to 'Block'

A file policy with a condition for 'Location'

A session policy with a condition for 'Location' and set the action to 'Block'

Microsoft 365 Certified:Administrator Expert

Domain 3Objective 4

Implement and Manage Microsoft Defender for Cloud Apps MS-102 Practice Questions (Page 4)

Part of the Manage security and threats by using Microsoft Defender XDR domain, which accounts for 30–35% of the MS-102 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~12–23 in this domain), expect 3–6 from this objective — we provide 33 practice questions to prepare you well beyond it. (estimate)

33questions here

7free pages

6concepts

30–35%of the exam

Questions 16–20

16expert · hard
A multinational company has offices in the US and EU. They want to use Cloud App Discovery to identify shadow IT, but they are concerned about data residency and want to minimize the amount of data sent to the Defender for Cloud Apps backend. Which deployment approach should they use?
Select an answer first
17foundation · easy
When reviewing an activity log entry in Microsoft Defender for Cloud Apps, which field helps you identify the specific action performed by the user?
Select an answer first
18application · medium
A company wants to discover which cloud apps are being used by employees. They have deployed the Defender for Cloud Apps collector on their domain-joined Windows workstations. After two weeks, the Cloud App Discovery dashboard shows very low traffic. The security team suspects that some employees use non-domain-joined laptops. What should they do to improve visibility?
Select an answer first
19expert · hard
A company has deployed the Defender for Cloud Apps collector on a server that receives logs from their Cisco ASA firewall. The Cloud App Discovery report shows only a small percentage of expected traffic. The administrator suspects that some traffic is not being logged by the firewall. What should the administrator do to improve discovery coverage?
Select an answer first
20application · medium
A company wants to control access to Microsoft 365 apps based on the user's location. They have connected Microsoft 365 to Defender for Cloud Apps. They want to block access from countries that are not in the allowed list. What should they configure?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to MS-102

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “MS-102” is a trademark of its owner, used for identification only.

Implement and Manage Microsoft Defender for Cloud Apps MS-102 Practice Questions (Page 4)

Questions 16–20

A multinational company has offices in the US and EU. They want to use Cloud App Discovery to identify shadow IT, but they are concerned about data residency and want to minimize the amount of data sent to the Defender for Cloud Apps backend. Which deployment approach should they use?

When reviewing an activity log entry in Microsoft Defender for Cloud Apps, which field helps you identify the specific action performed by the user?

A company wants to control access to Microsoft 365 apps based on the user's location. They have connected Microsoft 365 to Defender for Cloud Apps. They want to block access from countries that are not in the allowed list. What should they configure?

Keep studying — Manage security and threats by using Microsoft Defender XDR