MS-900 Describe Microsoft 365 apps and services Practice Question
A company uses Microsoft 365 E5. The security team wants to automatically investigate and remediate advanced threats across email, endpoints, and identities. Which Microsoft 365 Defender workload should they enable?
⚠ Common exam trap
Candidates often confuse the individual Defender workloads (Identity, Endpoint, Office 365) with the integrated cross-domain solution (Defender XDR), mistakenly thinking one of the single-domain tools can automatically investigate and remediate across all three domains simultaneously.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Defender XDR
Microsoft Defender XDR (option D) is the correct answer because it is the unified, cross-domain security solution that correlates signals across email, endpoints, identities, and cloud apps to automatically investigate and remediate advanced threats. Unlike the individual Defender workloads, Defender XDR provides integrated incident response and automated actions across all these domains, which directly matches the requirement for automatic investigation and remediation across email, endpoints, and identities.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Defender for Identity
Why it's wrong here
Microsoft Defender for Identity focuses exclusively on protecting on-premises Active Directory by detecting malicious activity such as Pass-the-Hash, lateral movement, and privileged account misuse. Because it lacks visibility into cloud workloads, email, and endpoints, it cannot satisfy a requirement for cross-domain investigation and response.
- ✗
Microsoft Defender for Endpoint
Why it's wrong here
Microsoft Defender for Endpoint delivers endpoint detection and response (EDR) across Windows, macOS, Linux, Android, and iOS devices, identifying threats from user and device behavior. However, its scope is limited to endpoint telemetry; it does not ingest signals from identity, email, or cloud app activity, so it could not unify a cross-domain incident investigation.
- ✗
Microsoft Defender for Office 365
Why it's wrong here
Microsoft Defender for Office 365 protects Exchange Online, SharePoint Online, OneDrive for Business, and Teams by filtering phishing, malware, and collaboration-based attacks. But it operates only within the email and docs plane, leaving endpoint and identity threats invisible, which makes it insufficient for a comprehensive XDR strategy.
- ✓
Microsoft Defender XDR
Why this is correct
Microsoft Defender XDR is the correct solution because it is a unified, cross-domain security platform that aggregates and correlates alerts across identities, endpoints, email, collaboration, and cloud apps. Through the Microsoft 365 Defender portal, security teams can investigate a single incident timeline, automatically respond with AI-driven remediation, and leverage shared threat intelligence across all domains.
Go deeper
Related to this question
Learn chapter
Microsoft Entra External Identities (B2B)
Key term
Microsoft Defender XDR
Microsoft Defender XDR is a unified security platform that automatically correlates alerts from across an organization's endpoints, email, identities, and cloud apps to stop complex attacks.
Key term
Microsoft 365
Microsoft 365 is a subscription-based cloud service from Microsoft that combines productivity tools like Office apps with security, device management, and online storage.
About these practice questions
Courseiva writes every MS-900 question from scratch — 794 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-900 exam.