MS-900 Microsoft Defender for Endpoint Practice Question
A business stakeholder asks how Microsoft 365 can help them protect Windows endpoints with endpoint detection and response capabilities. Microsoft security, identity, or compliance capability should it use?
⚠ Common exam trap
Many candidates confuse general productivity tools (Planner, Forms, Stream) with security capabilities, failing to recognize that only Microsoft Defender for Endpoint is purpose-built for endpoint detection and response (EDR) in Microsoft 365.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Defender for Endpoint
Microsoft Defender for Endpoint is the correct choice because it provides endpoint detection and response (EDR) capabilities specifically designed to protect Windows endpoints. It uses behavioral sensors, cloud analytics, and threat intelligence to detect, investigate, and respond to advanced threats in real time, aligning directly with the stakeholder's request.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Planner
Why it's wrong here
Microsoft Planner organises tasks into plans and buckets; it performs no endpoint detection or response. It is tempting because it is a Microsoft 365 service for coordinating work, which suits team task-management scenarios rather than securing Windows endpoints.
- ✗
Microsoft Forms
Why it's wrong here
Microsoft Forms collects surveys, quizzes and responses; it offers no endpoint detection or response capability. It is tempting because it is a lightweight Microsoft 365 service for gathering input, which suits feedback and assessment scenarios rather than defending Windows devices.
- ✗
Microsoft Stream
Why it's wrong here
Microsoft Stream hosts and shares video content; it provides no endpoint detection and response telemetry or remediation. It is tempting because it is a Microsoft 365 service for enterprise media, which suits internal video communication scenarios rather than protecting Windows endpoints.
- ✓
Microsoft Defender for Endpoint
Why this is correct
Microsoft Defender for Endpoint delivers endpoint detection and response for Windows devices, including behavioural analytics, alerts and automated investigation. It is the Microsoft 365 security capability that satisfies the stakeholder's stated EDR requirement for Windows endpoints.
Go deeper
Related to this question
Learn chapter
Attack Simulator in Microsoft Defender
Key term
Microsoft Defender
Microsoft Defender is a suite of security products that protects devices, data, and identities from cyber threats like malware, phishing, and unauthorized access.
Key term
Endpoint detection and response
Endpoint detection and response (EDR) is a cybersecurity solution that continuously monitors endpoint devices for suspicious activity and automatically responds to threats to stop attacks in real time.
About these practice questions
Courseiva writes every MS-900 question from scratch — 794 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-900 exam.