A cloud access security broker (CASB) that discovers the cloud apps in use (shadow IT), assesses their risk, protects data in SaaS apps, and detects threats in them. With Conditional Access App Control it can control sessions in real time, for example by blocking downloads.
In SC-900 it is the answer for shadow IT and for controlling sessions from unmanaged devices. App governance, part of this product, detects OAuth apps with anomalous behavior.
Microsoft Defender for Cloud Apps is a concept that can show up on the exam. Check the full guide to see it in context.