mediumMultiple ChoiceObjective-mapped
MS-900 Practice Question: A company with 300 users currently has Microsoft…
A company with 300 users currently has Microsoft 365 Business Premium licenses. They want to add the highest level of automated threat investigation and response capabilities for all users. Which licensing option should they purchase?
⚠ Common exam trap
Many candidates confuse the Microsoft 365 E5 Security add-on (Option B) with the more targeted Defender for Office 365 Plan 2 add-on, not realizing that the E5 Security add-on includes additional, unnecessary features and costs more, while the question specifically asks for the highest level of automated threat investigation and response for all users, which is exactly what Defender for Office 365 Plan 2 provides.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add the Microsoft 365 Defender for Office 365 Plan 2 add-on for each user
Microsoft 365 Defender for Office 365 Plan 2 provides the highest level of automated investigation and response (AIR) capabilities, including threat hunting, automated remediation, and simulation training. Since the company already has Microsoft 365 Business Premium, which includes Defender for Office 365 Plan 1, adding Plan 2 as an add-on is the most cost-effective way to achieve the desired capabilities without upgrading to E5.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Upgrade all users to Microsoft 365 E5
Why it's wrong here
Upgrade all users to Microsoft 365 E5: While Microsoft 365 E5 does include Defender for Office 365 Plan 2 and other advanced security features, moving all 300 users from Business Premium to E5 would raise per-user licensing cost from roughly $22 to about $57 per month, more than doubling your security spend. For a company that only needs the extra Defender for Office 365 Plan 2 capabilities, this is a costly over-provisioning that also requires licensing plan migration. It is better to keep Business Premium and purchase a targeted add-on.
- ✗
Add the Microsoft 365 E5 Security add-on for each user
Why it's wrong here
Add the Microsoft 365 E5 Security add-on: The Microsoft 365 E5 Security add-on bundles Defender for Endpoint, Identity, and Cloud Apps, but it is only designed for Microsoft 365 E3 or Office 365 E3 base plans, not for Business Premium. Business Premium is a separate product family that cannot accept this add-on, so attempting to assign it to Business Premium users will fail. It does not directly upgrade your existing Defender for Office 365 Plan 1 coverage to Plan 2, which is what the company actually needs.
- ✓
Add the Microsoft 365 Defender for Office 365 Plan 2 add-on for each user
Why this is correct
Add the Microsoft 365 Defender for Office 365 Plan 2 add-on: Business Premium already includes Microsoft Defender for Office 365 Plan 1, which provides safe links, safe attachments, and anti-phishing protection for email and SharePoint. Adding the Plan 2 add-on per user elevates that protection with advanced features such as automated investigation and response, threat hunting, and detailed incident reporting. This is the exact SKU designed to address your need for advanced investigation, and it should be licensed for every user who needs those capabilities.
- ✗
Add the Microsoft 365 Business Premium Threat Protection add-on
Why it's wrong here
Add the Microsoft 365 Business Premium Threat Protection add-on: Microsoft does not offer any add-on named 'Business Premium Threat Protection' in its product catalog. The only way to add additional Defender for Office 365 protection to Business Premium is through the Defender for Office 365 Plan 2 add-on, which provides the advanced capabilities you are looking for. This fictitious add-on is likely a confusion with the core Business Premium plan, which already includes some threat protection but cannot be extended by a similarly named SKU.
Go deeper
Related to this question
Learn chapter
Benefits of Microsoft Cloud
Key term
Defender for Office 365
Microsoft Defender for Office 365 is a cloud-based email security service that protects organizations against advanced threats like phishing, malware, and business email compromise by scanning emails, attachments, and links in real time.
Key term
Microsoft 365
Microsoft 365 is a subscription-based cloud service from Microsoft that combines productivity tools like Office apps with security, device management, and online storage.
About these practice questions
One of 217 original MS-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-900 exam.