SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
A company manages Azure virtual machines and on-premises servers. The security team needs a single dashboard that provides a secure score and actionable recommendations to improve the security posture across both environments. Which Microsoft solution should be used?
⚠ Common exam trap
Many exam-takers confuse Microsoft Defender for Cloud (formerly Azure Security Center) with Microsoft 365 Defender, assuming the latter covers all security needs, but Microsoft 365 Defender is limited to Microsoft 365 workloads and does not assess Azure or on-premises infrastructure security posture.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Defender for Cloud
Microsoft Defender for Cloud provides a unified dashboard that displays a secure score and actionable recommendations for Azure virtual machines, on-premises servers, and other cloud workloads. It integrates with Azure Arc to extend security monitoring to on-premises resources, enabling a single view of security posture across hybrid environments.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft 365 Defender portal
Why it's wrong here
The Microsoft 365 Defender portal unifies XDR (Extended Detection and Response) capabilities across Microsoft 365 services, including endpoints (Defender for Endpoint), identities (Defender for Identity), email and collaboration (Defender for Office 365), and cloud apps (Defender for Cloud Apps within the M365 context). Its focus is on detecting and responding to threats across these specific Microsoft 365 workloads. It does not provide the broad security posture management, secure score, or infrastructure-level recommendations required for general Azure virtual machines and on-premises servers.
When this WOULD be correct
A question asking for a solution to monitor and respond to threats across Microsoft 365 services (e.g., email, Office apps, identities) and provide a unified incident response experience would make Microsoft 365 Defender the correct answer.
- ✓
Microsoft Defender for Cloud
Why this is correct
Microsoft Defender for Cloud is the correct solution because it provides comprehensive Cloud Security Posture Management (CSPM) and Cloud Workload Protection Platform (CWPP) capabilities across Azure, on-premises, and multi-cloud environments. It delivers a secure score, actionable security recommendations, and advanced threat protection for virtual machines and servers, regardless of their hosting location. By integrating with Azure Arc, Defender for Cloud extends its security management and monitoring to on-premises servers, ensuring consistent security posture across the entire hybrid infrastructure.
- ✗
Microsoft Sentinel
Why it's wrong here
Microsoft Sentinel is a cloud-native Security Information and Event Management (SIEM) and Security Orchestration, Automation, and Response (SOAR) solution. Its primary function is to aggregate security data from various sources, detect threats using analytics and machine learning, and facilitate incident investigation and response. While Sentinel can ingest security alerts and logs from Defender for Cloud, it does not directly provide security posture management, secure score calculations, or proactive recommendations for hardening Azure VMs and on-premises servers.
When this WOULD be correct
An organization needs a cloud-native SIEM to collect security data from multiple sources, detect threats, and automate responses across the enterprise, including on-premises and multi-cloud environments.
- ✗
Microsoft Defender for Cloud Apps
Why it's wrong here
Microsoft Defender for Cloud Apps is a Cloud Access Security Broker (CASB) that focuses on securing Software as a Service (SaaS) applications and discovering shadow IT. It provides visibility into cloud app usage, identifies sensitive data, and protects against threats within those applications. This solution is designed for application-level security, data governance, and compliance for SaaS environments, not for managing the security posture or providing recommendations for underlying infrastructure like Azure virtual machines or on-premises servers.
When this WOULD be correct
When the question asks for a solution to discover and control the use of cloud apps, enforce data loss prevention policies, and assess the security posture of SaaS applications like Office 365 or Salesforce.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SC-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Microsoft Defender for CloudCorrect answer▾
Why this is correct
Microsoft Defender for Cloud is the correct solution because it provides comprehensive Cloud Security Posture Management (CSPM) and Cloud Workload Protection Platform (CWPP) capabilities across Azure, on-premises, and multi-cloud environments. It delivers a secure score, actionable security recommendations, and advanced threat protection for virtual machines and servers, regardless of their hosting location. By integrating with Azure Arc, Defender for Cloud extends its security management and monitoring to on-premises servers, ensuring consistent security posture across the entire hybrid infrastructure.
✗Microsoft 365 Defender portalWrong answer — click to see why▾
Why this is wrong here
The Microsoft 365 Defender portal focuses on securing Microsoft 365 workloads (email, endpoints, identities) and does not provide a unified secure score or recommendations for Azure VMs and on-premises servers.
★ When this WOULD be the correct answer
A question asking for a solution to monitor and respond to threats across Microsoft 365 services (e.g., email, Office apps, identities) and provide a unified incident response experience would make Microsoft 365 Defender the correct answer.
Why candidates choose this
Candidates may confuse Microsoft 365 Defender with Defender for Cloud because both have 'Defender' in the name and offer security dashboards, but they serve different scopes.
✗Microsoft SentinelWrong answer — click to see why▾
Why this is wrong here
Microsoft Sentinel is a SIEM/SOAR solution for security analytics and threat detection, not a dashboard for secure score and posture recommendations across hybrid environments.
★ When this WOULD be the correct answer
An organization needs a cloud-native SIEM to collect security data from multiple sources, detect threats, and automate responses across the enterprise, including on-premises and multi-cloud environments.
Why candidates choose this
Candidates may confuse Sentinel's security monitoring capabilities with Defender for Cloud's posture management, thinking Sentinel provides the secure score dashboard when it actually focuses on threat detection and incident response.
✗Microsoft Defender for Cloud AppsWrong answer — click to see why▾
Why this is wrong here
Microsoft Defender for Cloud Apps is a cloud access security broker focused on SaaS applications, not on providing a unified secure score and recommendations for Azure VMs and on-premises servers.
★ When this WOULD be the correct answer
When the question asks for a solution to discover and control the use of cloud apps, enforce data loss prevention policies, and assess the security posture of SaaS applications like Office 365 or Salesforce.
Why candidates choose this
Candidates may confuse Defender for Cloud Apps with Defender for Cloud because both have 'Defender' in the name and relate to security posture, but they target different environments.
Analysis generated from the official SC-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Azure Arc
Azure Arc is a Microsoft service that lets you manage servers, Kubernetes clusters, and databases running outside of Azure as if they were native Azure resources.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.