hardMultiple ChoiceObjective-mapped
MS-900 Practice Question: A multinational organization with 500 users…
A multinational organization with 500 users currently has Microsoft 365 E3 licenses. They need to perform advanced threat hunting using queries across email, endpoints, and identities to investigate a security incident. They also need the ability to automatically isolate infected endpoints. What is the most cost-effective licensing addition?
⚠ Common exam trap
It's easy for candidates to confuse Microsoft 365 E5 Security with the full Microsoft 365 E5 license, assuming the full E5 is required for security features, when in fact the Security add-on provides the specific threat hunting and isolation capabilities at a lower cost.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft 365 E5 Security
Microsoft 365 E5 Security is the most cost-effective addition because it provides advanced threat hunting via Microsoft 365 Defender (including queries across email, endpoints, and identities) and automated endpoint isolation through Microsoft Defender for Endpoint. This add-on delivers the required capabilities without the full cost of upgrading all users to Microsoft 365 E5, which would also include unnecessary features like advanced compliance and analytics.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Microsoft 365 E5 Security
Why this is correct
Microsoft 365 E5 Security is a targeted add-on for organizations on Microsoft 365 E3 that unlocks the full Microsoft 365 Defender stack. This includes Defender for Endpoint P2, Defender for Office 365 P2, Defender for Identity, and Defender for Cloud Apps, enabling advanced threat hunting via KQL, automated investigation and response, and automated endpoint isolation. It provides comprehensive security operations capabilities without the extra cost of non-security features found in the full E5 suite.
- ✗
Microsoft 365 E5
Why it's wrong here
Selecting Microsoft 365 E5 would upgrade the entire tenant to the premium suite, which is substantially more expensive than the E5 Security add-on. While full E5 does include all the E5 Security components, it also bundles E5 Compliance, Power BI Pro, and telephony features that are not required for the stated threat-hunting and endpoint-isolation needs. This over-provisioning increases license costs without delivering any additional security benefit beyond what the add-on already provides.
- ✗
Microsoft 365 E5 Compliance
Why it's wrong here
Microsoft 365 E5 Compliance is designed for information governance, eDiscovery, legal hold, audit, and retention policies, not for active threat hunting or endpoint response. Its capabilities such as communication compliance and insider risk management address regulatory and investigation workflows, whereas the requested scenario requires Defender's real-time detection and automated endpoint isolation. Relying on Compliance for this need would leave the organization without the necessary incident response and threat-hunting tools.
- ✗
Enterprise Mobility + Security (EMS) E5
Why it's wrong here
Incorrect. EMS E5 is an older bundle that includes Microsoft Entra ID P2 and Intune but does not include Microsoft 365 Defender for threat hunting. It is no longer the recommended add-on for this purpose.
Go deeper
Related to this question
Learn chapter
Benefits of Microsoft Cloud
Key term
Microsoft Defender
Microsoft Defender is a suite of security products that protects devices, data, and identities from cyber threats like malware, phishing, and unauthorized access.
Key term
Defender for Endpoint
Microsoft Defender for Endpoint is a cloud-delivered enterprise security solution designed to protect devices from cyber threats using behavioral analysis, machine learning, and automated investigation.
About these practice questions
One of 217 original MS-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-900 exam.