mediumMultiple ChoiceObjective-mapped
MS-900 Practice Question: A company with 250 users has Microsoft 365 E3…
A company with 250 users has Microsoft 365 E3 licenses. They want to add advanced anti-phishing and anti-malware protection for email and also deploy endpoint detection and response (EDR) for all devices. What is the most cost-effective licensing add-on?
⚠ Common exam trap
Watch out — candidates often confuse the 'Plan 1' vs 'Plan 2' tiers, assuming that any Defender add-on provides full EDR and advanced anti-phishing, when in reality Plan 1 lacks key features like automated investigation and advanced threat hunting.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft 365 E5 Security add-on
Microsoft 365 E5 Security add-on provides advanced anti-phishing and anti-malware protection via Microsoft Defender for Office 365 Plan 2 and includes Microsoft Defender for Endpoint Plan 2 for EDR capabilities. This is the most cost-effective option because it adds exactly the required security features to existing E3 licenses without the higher cost of a full E5 upgrade or the redundancy of separate plan 1 add-ons.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Microsoft 365 E5 Security add-on
Why this is correct
The Microsoft 365 E5 Security add-on is explicitly designed to extend E3 with advanced threat protection, bundling Defender for Microsoft 365 Plan 2 and Defender for Endpoint Plan 1. This bundle provides advanced hunting, automated investigation, and endpoint detection and response at a lower combined price than purchasing the components individually. It directly satisfies the company's security requirements without unnecessary extras, making it the optimal cost-effective choice.
- ✗
Microsoft Defender for Microsoft 365 Plan 1 and Microsoft Defender for Endpoint Plan 1 add-ons
Why it's wrong here
While you can acquire Microsoft Defender for Microsoft 365 Plan 1 and Microsoft Defender for Endpoint Plan 1 as separate add-ons, this combination is both more expensive and functionally inferior. Defender for Microsoft 365 Plan 1 is a lower tier that lacks advanced hunting, automated investigation, and threat analytics capabilities included in Plan 2, which is part of the E5 Security add-on. Thus, this option neither matches the required security capabilities nor offers the cost benefit of the bundled add-on.
- ✗
Microsoft 365 E5 Compliance add-on
Why it's wrong here
The Microsoft 365 E5 Compliance add-on focuses on information governance and regulatory obligations, providing features like retention policies, eDiscovery, and communication compliance. It does not include threat protection capabilities such as Defender for Endpoint or Defender for Microsoft 365, which are essential for securing endpoints and email against advanced attacks. Selecting this add-on would leave the company's environment exposed from a security perspective.
- ✗
Upgrade all users to Microsoft 365 E5
Why it's wrong here
Upgrading all 250 users to Microsoft 365 E5 licenses would indeed include the same security features as the E5 Security add-on, but it also brings advanced compliance, analytics, and other capabilities that are not required here. The incremental cost of full E5 licenses is significantly higher than staying on E3 and adding the Security add-on, creating unnecessary expenditure for features the company will not use. A targeted add-on is the more efficient licensing path.
Go deeper
Related to this question
Learn chapter
Benefits of Microsoft Cloud
Key term
Defender for Endpoint
Microsoft Defender for Endpoint is a cloud-delivered enterprise security solution designed to protect devices from cyber threats using behavioral analysis, machine learning, and automated investigation.
Key term
Endpoint detection and response
Endpoint detection and response (EDR) is a cybersecurity solution that continuously monitors endpoint devices for suspicious activity and automatically responds to threats to stop attacks in real time.
About these practice questions
One of 217 original MS-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-900 exam.