MS-900 Question #330: Real Exam Question with Answer & Explanation

Question

Hotspot Question Instructions: For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point. Answer:

Options

• __typehotspot
• variantyes_no

Explanation

The question requires evaluating three statements about Microsoft Defender for Cloud Apps (MDCA) integrations, all of which are true: MDCA integrates with the Intelligent Security Graph to inform Defender for Identity alerts, contributes to Secure Score, and integrates with the Power Platform (including Power Automate for automation) which can be reported on by Power BI.

Approach. To correctly answer this question, select 'Yes' for all three statements based on the following reasoning:

1. Statement 1: 'Microsoft Defender for Cloud Apps integrates with the Intelligent Security Graph to generate Microsoft Defender for Identity alerts.' (Select Yes)

   • Reasoning: Microsoft Defender for Cloud Apps (MDCA) is a critical component of the Microsoft 365 Defender suite. It continuously feeds signals and alerts into the broader Microsoft security ecosystem, which leverages the Microsoft Intelligent Security Graph (ISG) (now largely unified under the Microsoft 365 Defender portal and XDR capabilities). Identity-related threats detected by MDCA in cloud apps are correlated with data from Microsoft Defender for Identity (MDI). While MDCA generates its own alerts, these alerts contribute to the overall intelligence that informs and enhances MDI's threat detection and can be viewed holistically in the unified portal, effectively contributing to a comprehensive identity threat picture that MDI also addresses.

2. Statement 2: 'Microsoft Defender for Cloud Apps integrates with Secure Score to report the available security features that may reduce risk.' (Select Yes)

   • Reasoning: Microsoft Secure Score is a tool that measures an organization's security posture and provides recommendations to improve it. Configurations and implemented security controls within various Microsoft products, including Defender for Cloud Apps, directly impact the Secure Score. Enabling features like Conditional Access App Control, creating robust policies within MDCA, and discovering/controlling shadow IT all contribute to improving an organization's Secure Score by reducing risk. Therefore, MDCA is a direct contributor and integrator with Secure Score.

3. Statement 3: 'Microsoft Defender for Cloud Apps integrates with Microsoft Power BI to automate a response when alerts are triggered.' (Select Yes)

   • Reasoning: This statement requires a nuanced understanding. While Microsoft Power BI itself is primarily a business intelligence and data visualization tool and does not directly automate responses, Microsoft Defender for Cloud Apps does integrate with the broader Microsoft Power Platform. This platform includes Power Automate (formerly Microsoft Flow), which is designed for workflow automation. MDCA alerts can be exported to Azure Log Analytics or directly sent to Power Automate, which can then trigger automated responses (e.g., block users, revoke sessions, send notifications). Power BI can then be used to report on these alerts and the effectiveness of the automated responses. Given the exam context, the statement likely implies the integration with the Power Platform's automation capabilities, of which Power BI is a part for reporting and visualization within the broader ecosystem.

Common mistakes.

• common_mistake. Common mistakes include misunderstanding the specific functions of each integrated service. For instance, incorrectly assuming:

• Statement 1: That MDCA operates in complete isolation from other Defender products or the underlying intelligence platform (ISG). A test-taker might think MDCA only generates its own alerts and doesn't feed into other Defender services like MDI for correlated identity threats.
• Statement 2: That Secure Score only applies to core Azure AD or M365 services, not specialized security tools like MDCA. Overlooking MDCA's role in improving overall security posture via Secure Score is a common pitfall.
• Statement 3: Strictly interpreting 'Microsoft Power BI' to only mean its data visualization function. A common mistake is to choose 'No' because Power BI doesn't directly automate actions. However, ignoring the broader context of the Microsoft Power Platform, which does enable automation via Power Automate in conjunction with MDCA alerts, would lead to an incorrect answer, especially if the question implicitly refers to the platform's capabilities.

Concept tested. The core concept tested is the integration capabilities of Microsoft Defender for Cloud Apps (MDCA) within the broader Microsoft 365 Defender ecosystem. This includes its interoperability with the Microsoft Intelligent Security Graph/Microsoft 365 Defender for unified threat detection and correlation (especially with Defender for Identity), its contribution to Microsoft Secure Score for security posture management, and its ability to integrate with the Microsoft Power Platform for reporting (Power BI) and automation of responses (Power Automate).

No community discussion yet for this question.