Describe the capabilities of Microsoft security solutions →hardMultiple ChoiceObjective-mapped

SC-900 Practice Question: Describe the capabilities of Microsoft security solutions

A company is designing a Microsoft 365 Defender incident response workflow. They want to automatically isolate a compromised device when a ransomware alert is triggered. Which Microsoft 365 component should be used to execute the automated response action?

⚠ Common exam trap

Many exam-takers confuse Microsoft Sentinel's SOAR capabilities (which can trigger isolation via playbooks) with the native automated response engine in Defender for Endpoint, but Sentinel is an orchestrator, not the component that directly executes the endpoint isolation action.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Microsoft Defender for Endpoint

Microsoft Defender for Endpoint includes automated investigation and remediation (AIR) capabilities that can isolate a device from the network when a ransomware alert is triggered. This is the correct component because it provides endpoint detection and response (EDR) with built-in playbooks for automatic containment actions like device isolation.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Microsoft Defender for Endpoint
Why this is correct
Microsoft Defender for Endpoint is the primary Endpoint Detection and Response (EDR) solution within the Microsoft 365 Defender suite, specifically designed for device-level protection. It includes robust Automated Investigation and Remediation (AIR) capabilities that leverage AI and machine learning to automatically analyze alerts, correlate events, and take immediate actions such as isolating devices, stopping processes, or quarantining files upon detection of a threat. These capabilities are fundamental for rapid incident response directly on the endpoint.
✗
Microsoft Defender for Office 365
Why it's wrong here
Microsoft Defender for Office 365 focuses exclusively on protecting email, SharePoint Online, OneDrive for Business, and Microsoft Teams from advanced threats like phishing, business email compromise, and malware. While it provides sophisticated threat protection and remediation within these collaboration services, it does not possess the inherent capabilities to perform device-level actions such as isolating an endpoint or directly remediating threats on the operating system itself. Its scope is confined to the M365 productivity ecosystem.
✗
Microsoft Sentinel
Why it's wrong here
Microsoft Sentinel is a cloud-native Security Information and Event Management (SIEM) and Security Orchestration, Automation, and Response (SOAR) solution that aggregates security data from various sources, including Defender products. While Sentinel can orchestrate automated responses through playbooks, it is not the native engine for performing real-time, deep-level automated investigation and remediation directly on an endpoint. It relies on the underlying Defender products, like Defender for Endpoint, to execute those specific device-centric actions.
✗
Microsoft Purview
Why it's wrong here
Microsoft Purview is a comprehensive suite of solutions focused on data governance, data protection, and risk management across an organization's digital estate. Its capabilities include data classification, data loss prevention (DLP), eDiscovery, and insider risk management, all centered around managing and protecting sensitive information. Purview does not include any features for active threat detection, incident response, or endpoint-level remediation actions such as device isolation, as its purpose is distinct from security operations.

Go deeper

SC-900 Practice Question: Describe the capabilities of Microsoft security solutions

Why each option matters

Option-by-option breakdown

Related to this question