The Cloud App Discovery feature in Microsoft Defender for Cloud Apps (formerly Cloud App Security) is designed to identify and analyze shadow IT-applications being accessed by users that are not managed by IT.
By importing firewall or proxy logs, Defender for Cloud Apps can automatically detect unmanaged external SaaS applications and the users accessing them. The study guide specifically states:
"Cloud App Discovery analyzes traffic logs from your firewalls and proxies to identify cloud applications used by your organization and provides visibility into usage and risk levels." Therefore, to identify unmanaged external apps and the users accessing them using firewall logs, Cloud App Discovery is the correct Microsoft tool.