Which Cloud Discovery Report Identifies Most-Used Apps in 30 Days?

Answer Correct answer: B — Generate a Cloud Discovery snapshot report to identify which cloud apps and services were used most during the last 30 days.

You have a Microsoft 365 E5 subscription that contains devices onboarded to Microsoft Defender for Endpoint. You integrate Microsoft Defender for Cloud Apps with Defender for Endpoint. You need identify which cloud apps and services were used most during the last 30 days. What should you do?

  1. Generate a monthly security summary report.
  2. Generate a Cloud Discovery snapshot report. Correct Answer
  3. Create a threat analytics alert notification.
  4. Generate a Cloud Discovery executive report.
cloud discovery snapshot report defender for cloud apps ms-102 cloud discovery most used cloud apps

Community Votes

B
100%

100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

It tests the difference between Cloud Discovery snapshot and executive reports; the trap is assuming the executive report (broad overview) answers a specific 30-day usage query.

This MS-102 question tests how to identify which cloud apps and services were used most during the last 30 days in Microsoft Defender for Cloud Apps. The correct action is to generate a Cloud Discovery snapshot report, which provides focused, time-bound analytics of discovered apps.

Many learners choose the Cloud Discovery executive report (D) because it sounds like a summary, but it offers a broad, high-level overview rather than the focused, last-30-days app usage detail available in a snapshot report.

Community Discussion (5 comments)

004b54b 👍 1 Selected: D
Executive report: The Cloud discovery page provides a dashboard designed to >>give you more insight<< (=identify) into how cloud apps are being used in your organization. The dashboard provides an at-a-glance view of the types of apps being used, your open alerts, and the risk levels of apps in your organization. https://learn.microsoft.com/en-us/defender-cloud-apps/discovered-apps Snapshot reports: https://learn.microsoft.com/en-us/defender-cloud-apps/create-snapshot-cloud-discovery-reports To create a snapshot report: 1. Collect log files from your firewall and proxy, through which users in your organization access the Internet. Make sure to gather logs during times of peak traffic that are representative of all user activity in your organization. Can't be used for last 30 days, 30 days is not a "snapshot" Answer is D.
justITtopics 👍 3 Selected: B
I thought it clould be Executive Report, so I asked AI to understand the differences between Snapshot Report and Executive Report: The summary is: The Cloud Discovery Executive Report provides a general and broad view, while the Cloud Discovery Snapshot Report provides focused information.
Ody 👍 1
Disagree. I think B is the correct answer. Here is what is contained in the monthly Endpoint report: Microsoft Secure Score Secure score compared to other organizations Devices onboarded Protection against threats Web content monitoring and filtering Suspicious or malicious activities
Tr619899 👍 2
To identify which cloud apps and services were used most during the last 30 days in Microsoft Defender for Cloud Apps, you should generate a Cloud Discovery snapshot report (Option B). This report provides ad-hoc visibility on a specific set of traffic logs that you manually upload from your network. It allows you to analyze your organization's cloud app usage against Microsoft's catalog of cloud apps, which can give insights into usage patterns and potential security risks https://learn.microsoft.com/en-us/defender-cloud-apps/create-snapshot-cloud-discovery-reports
HelloItsSam 👍 3 Selected: B
Should be Snapshot report

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Expert Analysis

Why the Answer Is Correct

The Cloud Discovery snapshot report is specifically designed for ad-hoc, focused analysis of cloud app usage over a defined time range, such as the last 30 days. When Defender for Endpoint is integrated with Defender for Cloud Apps, traffic logs are automatically streamed, and generating a snapshot report allows you to see exactly which apps and services were used most, including traffic volume and user counts. Microsoft's documentation describes the snapshot report as providing a detailed view that can be filtered by date, making it the right tool to answer a targeted 30-day usage question. In contrast, the executive report is a higher-level summary intended for scheduled distribution to management, not for granular investigation. Therefore, B is the correct action.

Why the Other Options Are Wrong

Option A (monthly security summary report) is unrelated to Cloud Discovery and focuses on overall security posture, not app usage. Option C (threat analytics alert notification) is for threat intelligence alerts and does not report on cloud app consumption. Option D (Cloud Discovery executive report) provides a broad, high-level overview that may be scheduled and lacks the granular, date-range-filtered detail needed to pinpoint the most-used apps in the last 30 days. While the executive report can show top apps, it is not the ad-hoc, focused report that the question demands.

Community Comment Notes

justITtopics initially considered the executive report but later chose B after comparing the two, noting that "The Cloud Discovery Executive Report provides a general and broad view" while the snapshot report is focused. HelloItsSam simply stated "Should be Snapshot report," aligning with the majority. 004b54b argued for D by linking to the discovered-apps dashboard, but that dashboard is not the executive report and does not replace the snapshot report's specific time-bound analysis. Ody also disagreed with alternative answers and supported B.

Official Reference

Exam Strategy

Memorize the distinction: snapshot reports are ad-hoc, detailed, and filterable by date range for specific investigations; executive reports are scheduled, high-level summaries for leadership. In exam questions, look for keywords like 'most used' and 'last 30 days' to choose the snapshot report over the executive report.

Frequently Asked Questions

Why is the Cloud Discovery executive report not the correct answer?

The executive report provides a broad, scheduled overview for management, while the snapshot report offers focused, date-range-specific detail needed to identify the most-used apps in the last 30 days.

Can I use the Cloud Discovery dashboard instead of generating a snapshot report?

The dashboard shows live data, but generating a snapshot report gives you a shareable, time-bound analysis specifically for the last 30 days, which directly answers the question.

Related Analysis

Your company has a Microsoft Entra tenant named contoso.com

S-Grade

You have a Microsoft 365 E5 subscription and use Microsoft D

S-Grade

You have a Microsoft 365 E5 subscription. From the Microsoft

S-Grade

Practice All MS-102 Questions

Access 111 questions with complete answers and detailed explanations.

View Full MS-102 Practice Test →

← Back to MS-102 Study Guide