Exam SC-300 topic 4 question 52 discussion

Unsanctioning an app doesn't block use, but enables you to more easily monitor its use with the Cloud Discovery filters. You can then notify users of the unsanctioned app and suggest an alternative safe app for their use, or generate a block script using the Defender for Cloud Apps APIs to block all unsanctioned apps. https://learn.microsoft.com/en-us/defender-cloud-apps/governance-discovery#sanctioningunsanctioning-an-app

How does unsanctioning an app which effectively block access to the app give you an insight to which users access it on their device? i dont see how D is the answer to this question. I believe creating a CLOUD APP ACCESS POLICY is what is needed. Please correct me if i am wrong

Answer D) From the Microsoft Defender for Cloud Apps portal, unsanction Facebook. https://learn.microsoft.com/en-us/defender-cloud-apps/governance-discovery#sanctioningunsanctioning-an-app

You can mark a specific risky app as unsanctioned by clicking the three dots at the end of the row. Then select Unsanctioned. Unsanctioning an app doesn't block use, but enables you to more easily monitor its use with the cloud discovery filters.

I'm going B - In response to those saying D because of administrative effort: Why Access Policy Minimizes Administrative Effort: Automated Monitoring: Once the access policy is set up, it automatically tracks and logs user activity, reducing the need for manual monitoring. Real-Time Alerts: Access policies can be configured to provide real-time alerts on specific activities, enabling proactive management. Comprehensive Reporting: Provides detailed reports on user activity, making it easier to identify and analyze usage patterns. In comparison, unsanctioning Facebook (option D) would involve more ongoing manual effort to monitor and interpret usage data without the same level of automation and control.

Need to create a policy first so we can monitor the logs and take action, I guess B is the right option here

o identify which users are accessing Facebook from their devices and browsers while minimizing administrative effort, you should first: B. Create a Defender for Cloud Apps access policy. A Defender for Cloud Apps access policy allows you to monitor and control user activities in cloud apps, including identifying access to unsanctioned apps like Facebook. By creating this policy, you can track user access to Facebook and enforce conditional rules if necessary.

Unsanctioning an app doesn't block use, but enables you to more easily monitor its use with the Cloud Discovery filters

B. Create a Defender for Cloud Apps access policy to monitor Facebook access. This policy will track user activity on Facebook without needing extensive configuration on individual devices.

https://learn.microsoft.com/en-us/defender-cloud-apps/governance-discovery#sanctioningunsanctioning-an-app

yall are stupid asf. its D. read MS documentation before coming in here and giving wrong answers like little monkeys https://learn.microsoft.com/en-us/defender-cloud-apps/governance-discovery#sanctioningunsanctioning-an-app

Correct Answer is D: Sanctioning/unsanctioning an app: You can mark a specific risky app as unsanctioned by clicking the three dots at the end of the row. Then select Unsanctioned. Unsanctioning an app doesn't block use, but enables you to more easily monitor its use with the Cloud Discovery filters. You can then notify users of the unsanctioned app and suggest an alternative safe app for their use, or generate a block script using the Defender for Cloud Apps APIs to block all unsanctioned apps. https://learn.microsoft.com/en-us/defender-cloud-apps/governance-discovery#sanctioningunsanctioning-an-app

I mean it does say here on the Microsoft page itself that "Unsanctioning an app doesn't block use, but enables you to more easily monitor its use with the Cloud Discovery filters." Therefore I am leaning more to answer D. https://learn.microsoft.com/en-us/defender-cloud-apps/governance-discovery#sanctioningunsanctioning-an-app

Question clearly asks to get insights into the activity not block it, which un-sanctioning would do.

Agree with McDonald, I’m going to balance it up

https://learn.microsoft.com/en-us/defender-cloud-apps/governance-discovery#sanctioningunsanctioning-an-app

such a stupid question. First you can see it anyway dont need to unsanctioned the app. I can add a random Tag too. If you have MDE Integration, what you normal have if you are using CAS. Then you block unsancitoned apps automaticlly. If you enable network proteciton it will block it in all browser.