Microsoft MDCA-SESSION-TS Practice Test

MDCA-SESSION-TS practice test: what's covered

• Conditional Access App Control, reverse proxy, session policies and evidence

Free MDCA-SESSION-TS sample questions

1. A pilot user signs in to SharePoint Online from an unmanaged laptop, but downloads are not routed through Microsoft Defender for Cloud Apps. The Entra Conditional Access policy is enabled and targets SharePoint. What should the engineer verify first?

   • A. The policy uses the Session control option to route traffic through Conditional Access App Control
   • B. The SharePoint tenant has every site collection manually added as an app connector
   • C. The user is blocked by a separate access policy before authentication completes
   • D. The device has Defender for Endpoint installed because session control requires endpoint onboarding
   Show answer

   Correct: A. Conditional Access App Control is entered through an Entra Conditional Access session control that routes the selected cloud app through Defender for Cloud Apps. Manual site onboarding, pre-authentication blocking, or endpoint installation may matter in other controls, but they do not replace the Conditional Access session-control routing requirement.

2. A security admin wants evidence that an unmanaged browser session was proxied by Defender for Cloud Apps before troubleshooting a missing block action. Which two signals are most useful?

   • A. The browser URL or session path reflects the Defender for Cloud Apps reverse-proxy flow for the protected app
   • B. The Defender for Cloud Apps activity log shows app activity for the same user and time window
   • C. The user's mailbox audit log contains every page click from the browser
   • D. The Conditional Access policy list has more than one enabled policy
   Show answer

   Correct: A and B. A proxied session should produce reverse-proxy routing evidence and Defender for Cloud Apps activity evidence. Mailbox audit logs and the number of enabled Conditional Access policies do not prove that this browser session was actually controlled by Conditional Access App Control.

3. A Conditional Access policy routes all users to Defender for Cloud Apps, but the business wants to test with only ten users. What is the safest correction?

   • A. Scope the Conditional Access policy to a pilot group and keep break-glass exclusions documented
   • B. Keep all users targeted because session policies can silently ignore non-pilot users
   • C. Disable Defender for Cloud Apps globally and re-enable it only during office hours
   • D. Use a SharePoint permission group because Conditional Access cannot target user groups
   Show answer

   Correct: A. Pilot scoping belongs in Conditional Access targeting, with documented exclusions for emergency access. Relying on session policies to ignore non-pilot users still sends them through the proxy, and global disablement or SharePoint-only groups do not give clean identity-policy control.

4. A user can access the target SaaS app directly from a bookmark after the pilot starts, bypassing the expected session controls. Which design problem is most likely?

   • A. The app was not protected by a Conditional Access policy that forces eligible sign-ins through App Control
   • B. The session policy name does not contain the application vendor name
   • C. The user's browser did not clear cache after every single page transition
   • D. The Defender portal language setting is different from the user's browser language
   Show answer

   Correct: A. Session controls rely on routing eligible sign-ins through Conditional Access App Control. A cosmetic policy name, normal browser cache, or language setting cannot explain a consistent direct path that bypasses the reverse proxy.

5. A team confuses Defender for Cloud Apps access policies with session policies. Which two statements help separate the troubleshooting paths?

   • A. An access policy can allow or block access based on context before the app session continues
   • B. A session policy can monitor or control activities inside an active proxied session
   • C. An access policy can rewrite file downloads after the file has already reached the browser
   • D. A session policy can replace Entra Conditional Access targeting for initial app routing
   Show answer

   Correct: A and B. Access policies govern whether contextual access is allowed or blocked, while session policies inspect and control behavior during the app session. File download rewriting is a session-control action, and session policies do not replace the Conditional Access routing decision.

Last updated: 2026-10-19

MDCA-SESSION-TS practice test FAQ

Related practice tests

• Microsoft Defender XDR practice test
• Entra Conditional Access troubleshooting practice test
• Microsoft SC-200 practice test
• Microsoft SC-300 practice test
• Microsoft SC-401 practice test
• Entra Global Secure Access practice test