mediumMultiple ChoiceObjective-mapped
MS-900 Practice Question: A company with 500 Microsoft 365 E3 users wants…
A company with 500 Microsoft 365 E3 users wants to add the highest level of threat protection and advanced investigation capabilities for their security team. Which licensing add-on should they purchase?
⚠ Common exam trap
It's easy for candidates to confuse 'Microsoft 365 E5' (a full suite upgrade) with 'Microsoft 365 E5 Security' (an add-on), or they assume that Defender for Office 365 Plan 2 alone provides all advanced investigation features, when in fact E5 Security bundles multiple Defender plans and advanced hunting tools.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft 365 E5 Security
Microsoft 365 E5 Security is the correct add-on because it bundles the highest level of threat protection (Microsoft Defender for Office 365 Plan 2, Microsoft Defender for Endpoint Plan 2, and Microsoft Defender for Identity) along with advanced investigation capabilities like automated investigation and response (AIR), threat analytics, and advanced hunting in Microsoft 365 Defender. This meets the requirement for top-tier threat protection and advanced investigation without upgrading the entire E3 base license to E5.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Microsoft 365 E5 Security
Why this is correct
Microsoft 365 E5 Security is an add-on for E3 that includes advanced security features such as Microsoft 365 Defender, Defender for Microsoft 365 Plan 2, Defender for Identity, and more, providing the highest threat protection and investigation.
- ✗
Microsoft 365 E5 Compliance
Why it's wrong here
Microsoft 365 E5 Compliance is an add-on, but it governs data governance and legal requirements rather than providing advanced threat protection. It delivers eDiscovery, records management, Communications Compliance and insider risk management, plus some access controls such as Customer Lockbox and privileged access management. However, it lacks the core components needed for the scenario's security requirement—Defender for Endpoint, Defender for Office 365 Plan 2, and Defender for Identity—which are part of the E5 Security suite.
- ✗
Microsoft 365 E5
Why it's wrong here
Microsoft 365 E5 is a full product suite, not an add-on. While it includes the desired security, purchasing a full E5 license for users who already have E3 would be redundant and more expensive than the add-on.
- ✗
Microsoft Defender for Microsoft 365 Plan 2 only
Why it's wrong here
Subscribing to Microsoft Defender for Office 365 Plan 2 by itself only protects email and collaboration workloads such as Exchange Online and Microsoft Teams. The scenario asks for advanced security and investigation across the environment, which includes identity, endpoints, and cloud apps. E5 Security bundles Defender for Office 365 Plan 2 together with Defender for Identity, Defender for Endpoint, and unified incident response through Microsoft 365 Defender, making Plan 2 alone an incomplete and less cost-effective answer.
Go deeper
Related to this question
Learn chapter
Benefits of Microsoft Cloud
Key term
Microsoft Defender
Microsoft Defender is a suite of security products that protects devices, data, and identities from cyber threats like malware, phishing, and unauthorized access.
Key term
Defender for Office 365
Microsoft Defender for Office 365 is a cloud-based email security service that protects organizations against advanced threats like phishing, malware, and business email compromise by scanning emails, attachments, and links in real time.
About these practice questions
One of 217 original MS-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-900 exam.