mediumMultiple ChoiceObjective-mapped
MS-900 Practice Question: A company currently has Microsoft 365 E5 licenses…
A company currently has Microsoft 365 E5 licenses for all users. They need to perform advanced threat hunting using queries across email, endpoints, and identities to investigate a potential security incident. Which of the following capabilities is already included in their existing license?
⚠ Common exam trap
Test-takers frequently confuse Microsoft 365 Defender (the unified security suite) with its individual component plans (e.g., Defender for Office 365 Plan 1 or Plan 2), not realizing that advanced hunting is a feature of the full Microsoft 365 Defender included in E5, not a separate add-on.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft 365 Defender (including advanced hunting)
Microsoft 365 Defender (formerly Microsoft Threat Protection) includes advanced hunting capabilities that allow security teams to run Kusto Query Language (KQL) queries across email, endpoints, identities, and cloud apps. Since the company already has Microsoft 365 E5 licenses, this capability is included without any additional purchase.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Defender for Microsoft 365 Plan 1
Why it's wrong here
Microsoft Defender for Microsoft 365 Plan 1 provides essential email and collaboration security such as anti-phishing, safe attachments, and safe links, but it lacks the advanced hunting capability built into the full Microsoft 365 Defender suite. It cannot run raw Kusto Query Language (KQL) queries across emails, endpoints, or identity telemetry, and therefore cannot perform the cross-domain incident investigation described in the scenario. Plan 1 is a foundation, not a hunting platform.
- ✗
Microsoft Entra ID Premium P1
Why it's wrong here
Microsoft Entra ID Premium P1 adds identity governance features like Conditional Access, MFA, and self-service password reset, but it is not a security analytics or threat-hunting product. While it strengthens access control and identity posture, it offers no query interface for investigating raw telemetry or correlating events across your tenant. Threat hunting requires dedicated security data stores, not identity policy engines.
- ✓
Microsoft 365 Defender (including advanced hunting)
Why this is correct
Microsoft 365 Defender (including advanced hunting) is the correct choice because E5 includes the full unified security operations experience, enabling investigators to use KQL to query over email, endpoints, identities, and applications in one portal. Advanced hunting allows proactive, multi-domain searches for indicators of compromise, exactly what is needed when hunting for a cross-domain attack. This capability is exclusive to the combined Microsoft 365 Defender product, not to individual add-ons.
- ✗
Microsoft Cloud App Security
Why it's wrong here
Microsoft Cloud App Security (now Defender for Cloud Apps) is centered on Shadow IT discovery and applying access and session policies to SaaS apps, rather than on deep threat hunting. It can generate alerts and provide app risk scores, but it lacks the unified, advanced hunting schema that spans email and endpoint telemetry. Its role is more about cloud governance and app control, which is not the primary tool for investigating a potential incident across multiple domains.
Go deeper
Related to this question
Learn chapter
Cloud Service Types for MS-900
Key term
Microsoft 365
Microsoft 365 is a subscription-based cloud service from Microsoft that combines productivity tools like Office apps with security, device management, and online storage.
Key term
Incident
An incident is a security event that violates an organization's policies or threatens its data, systems, or operations, requiring a structured response.
About these practice questions
This MS-900 question is part of Courseiva's 217-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-900 exam.