SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
A company runs a mix of on-premises servers and Azure virtual machines. They deploy Microsoft Defender for Endpoint on all servers. The security team wants to create custom queries to hunt for a specific attack pattern that involves a sequence of events across multiple machines, such as a PowerShell script being downloaded and then executed on several servers. They need to write their own detection rules based on advanced hunting data. Which Microsoft 365 Defender capability should they use?
⚠ Common exam trap
It's easy for candidates to confuse Microsoft Sentinel's advanced hunting (which is also KQL-based but is a separate Azure service) with the advanced hunting capability native to Microsoft 365 Defender, leading them to select Sentinel even though the question explicitly asks for a Microsoft 365 Defender capability.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Advanced hunting in Microsoft 365 Defender
Advanced hunting in Microsoft 365 Defender provides a Kusto Query Language (KQL)-based query interface that allows security teams to create custom detection rules by searching raw data across endpoints, email, and identities. This capability directly supports the scenario of writing custom queries to hunt for multi-machine attack patterns, such as a PowerShell script download followed by execution, by correlating events like DeviceProcessEvents and DeviceFileEvents across multiple devices.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Advanced hunting in Microsoft 365 Defender
Why this is correct
Advanced hunting is a powerful, proactive threat hunting tool integrated directly within the Microsoft 365 Defender portal. It allows security analysts to leverage Kusto Query Language (KQL) to explore raw event data from various Microsoft 365 security products, including Defender for Endpoint, Defender for Office 365, Defender for Identity, and Microsoft Defender for Cloud Apps. This capability enables the creation of sophisticated custom detection rules and the identification of unique threats across endpoints, email, identities, and cloud applications from a single interface.
- ✗
Microsoft Defender for Cloud
Why it's wrong here
Microsoft Defender for Cloud (formerly Microsoft Defender for Cloud) provides security posture management and threat protection for cloud workloads, but does not offer the same level of custom KQL hunting across Microsoft 365 Defender data.
- ✗
Microsoft Defender for Office 365
Why it's wrong here
Microsoft Defender for Office 365 provides robust protection against email-borne threats, phishing, spam, and other collaboration-related risks within Exchange Online, SharePoint, OneDrive, and Microsoft Teams. While it offers its own set of alerts and reporting specific to the Office 365 environment, its primary function is securing these services. It does not provide a unified platform for custom KQL queries that span across endpoint data from Defender for Endpoint or identity data from Defender for Identity, which is essential for comprehensive cross-domain hunting.
- ✗
Microsoft Sentinel
Why it's wrong here
Microsoft Sentinel is a cloud-native SIEM/SOAR that supports KQL queries and custom analytics rules. However, the question explicitly asks for a capability within Microsoft 365 Defender, not a separate service. While Sentinel can ingest data from Defender, it is not part of the Microsoft 365 Defender portal.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Microsoft Defender
Microsoft Defender is a suite of security products that protects devices, data, and identities from cyber threats like malware, phishing, and unauthorized access.
Key term
Microsoft 365
Microsoft 365 is a subscription-based cloud service from Microsoft that combines productivity tools like Office apps with security, device management, and online storage.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.