MS-900 Describe Microsoft 365 apps and services Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Microsoft Intune

  Why it's wrong here

  Microsoft Intune is a cloud-based enterprise mobility management (EMM) service that handles mobile device management (MDM) and mobile application management (MAM). It is used to enforce configuration policies, deploy apps, and ensure device compliance, but it does not perform automated investigation or remediation of cyber threats. While Intune can be used to remotely wipe or retire a device after a compromise, it lacks the built-in detection engines and automatic response capabilities that define an endpoint detection and response (EDR) tool.

• ✗

  Microsoft Purview

  Why it's wrong here

  Microsoft Purview is a comprehensive set of solutions for data governance, compliance, and risk management, including data classification, data loss prevention (DLP), eDiscovery, and insider risk management. It is designed to help organizations meet regulatory requirements, protect sensitive information, and manage legal discovery, not to identify or automatically remediate active security threats. Purview's primary focus is on data that is at rest or in use, whereas automated threat remediation requires real-time telemetry and response actions on live endpoints, which is not its purpose.

• ✓

  Microsoft Defender XDR

  Why this is correct

  Microsoft Defender XDR (formerly Microsoft 365 Defender) is the correct answer because it is a unified security platform that provides automated investigation and remediation across endpoints, email, identities, and cloud apps. It uses the Microsoft Defender for Endpoint EDR engine, which continuously monitors endpoint behaviors, detects advanced threats using AI and machine learning, and automatically executes response actions such as quarantining malicious files, isolating compromised devices, blocking indicators, and rolling back registry changes. These automated response playbooks reduce the time to respond and are precisely what the security team needs for proactive threat remediation.

• ✗

  Microsoft Sentinel

  Why it's wrong here

  Microsoft Sentinel is a cloud-native security information and event management (SIEM) plus security orchestration, automation, and response (SOAR) solution. While Sentinel can collect security telemetry from various sources and run automated playbooks to respond to incidents, it is fundamentally a log analytics and alert correlation platform, not an endpoint remediation engine. Its automation is driven by custom analytics rules and workflows that require configuration, whereas the automatic endpoint remediation described in the scenario is a built-in feature of Microsoft Defender XDR. Sentinel typically complements Defender XDR by providing broader visibility across the enterprise, but it does not inherently remediate endpoints on its own.

Go deeper

Related to this question