SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
A company runs a production Kubernetes cluster in Azure. The security team needs to continuously monitor the cluster for misconfigurations, such as containers running with privileged access or secrets exposed in environment variables. They also want to detect runtime threats like crypto-mining containers. Which Microsoft security solution should they use?
⚠ Common exam trap
Candidates often confuse Microsoft Sentinel's log aggregation capabilities with the proactive, agent-based posture management and runtime detection that Defender for Cloud provides specifically for Kubernetes workloads.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Defender for Cloud
Microsoft Defender for Cloud provides Cloud Security Posture Management (CSPM) and Cloud Workload Protection Platform (CWPP) capabilities. It continuously assesses Kubernetes clusters against the CIS Kubernetes Benchmark, detecting misconfigurations like privileged containers and exposed secrets in environment variables, and uses behavioral analytics to detect runtime threats such as crypto-mining containers.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Microsoft Defender for Cloud
Why this is correct
Microsoft Defender for Cloud is the correct solution because it provides comprehensive Cloud Security Posture Management (CSPM) and Cloud Workload Protection Platform (CWPP) capabilities specifically for Azure Kubernetes Service (AKS). It offers continuous security recommendations for AKS configurations, scans container images for vulnerabilities, and detects runtime threats within the cluster, including suspicious activities at the pod and node level, making it the primary tool for securing Kubernetes.
- ✗
Microsoft Sentinel
Why it's wrong here
Microsoft Sentinel is a cloud-native Security Information and Event Management (SIEM) and Security Orchestration, Automation, and Response (SOAR) solution. Its role is to aggregate security data from various sources, including alerts from Defender for Cloud, analyze it for threats, and automate incident response. While crucial for centralized security operations and ingesting Kubernetes-related logs, Sentinel itself does not provide the direct, native security posture management or runtime protection capabilities for a Kubernetes cluster; it consumes and acts upon data from other security services.
When this WOULD be correct
An organization needs to aggregate security logs from multiple sources (e.g., Azure, on-premises, other clouds) and use advanced analytics to detect and respond to complex threats across the entire environment, including custom detection rules and automated incident response.
- ✗
Microsoft Defender for Endpoint
Why it's wrong here
Microsoft Defender for Endpoint is an Enterprise Endpoint Detection and Response (EDR) solution primarily focused on securing traditional endpoints such as Windows, macOS, Linux servers, and mobile devices. While it could theoretically be deployed on the underlying virtual machines that serve as Kubernetes worker nodes, it lacks native Kubernetes-aware security features like control plane monitoring, pod-level threat detection, or container image scanning, providing only host-level protection rather than comprehensive cluster security.
When this WOULD be correct
An exam question asking for a solution to protect endpoints (e.g., desktops, laptops, servers) from malware, fileless attacks, or advanced persistent threats, with requirements for endpoint detection and response (EDR) and antivirus capabilities.
- ✗
Microsoft Defender for Cloud Apps
Why it's wrong here
Microsoft Defender for Cloud Apps (formerly Microsoft Cloud App Security) functions as a Cloud Access Security Broker (CASB) and is designed to protect SaaS applications like Microsoft 365, Salesforce, or other third-party cloud apps. Its focus is on discovering shadow IT, enforcing data loss prevention policies, and detecting anomalous user behavior within these specific application environments, not on the underlying infrastructure or workloads of a Kubernetes cluster.
When this WOULD be correct
A company wants to discover and control the use of shadow IT SaaS applications, enforce data loss prevention policies for cloud apps, and detect anomalous user behavior in Office 365 or other SaaS platforms.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SC-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Microsoft Defender for CloudCorrect answer▾
Why this is correct
Microsoft Defender for Cloud is the correct solution because it provides comprehensive Cloud Security Posture Management (CSPM) and Cloud Workload Protection Platform (CWPP) capabilities specifically for Azure Kubernetes Service (AKS). It offers continuous security recommendations for AKS configurations, scans container images for vulnerabilities, and detects runtime threats within the cluster, including suspicious activities at the pod and node level, making it the primary tool for securing Kubernetes.
✗Microsoft SentinelWrong answer — click to see why▾
Why this is wrong here
Microsoft Sentinel is a SIEM/SOAR solution for security analytics and threat intelligence, not a dedicated tool for continuous monitoring of Kubernetes misconfigurations or runtime threats like crypto-mining. Defender for Cloud provides native Kubernetes workload protection.
★ When this WOULD be the correct answer
An organization needs to aggregate security logs from multiple sources (e.g., Azure, on-premises, other clouds) and use advanced analytics to detect and respond to complex threats across the entire environment, including custom detection rules and automated incident response.
Why candidates choose this
Candidates may confuse Sentinel's broad security analytics capabilities with the specific Kubernetes workload protection offered by Defender for Cloud, or assume that any Microsoft security tool can handle container monitoring.
✗Microsoft Defender for EndpointWrong answer — click to see why▾
Why this is wrong here
Microsoft Defender for Endpoint focuses on endpoint devices (e.g., servers, workstations) and does not provide Kubernetes-specific misconfiguration monitoring or runtime threat detection for containers.
★ When this WOULD be the correct answer
An exam question asking for a solution to protect endpoints (e.g., desktops, laptops, servers) from malware, fileless attacks, or advanced persistent threats, with requirements for endpoint detection and response (EDR) and antivirus capabilities.
Why candidates choose this
Candidates may assume 'Defender for Endpoint' covers all security scenarios because of the broad 'Defender' branding, or they confuse container runtime protection with endpoint protection.
✗Microsoft Defender for Cloud AppsWrong answer — click to see why▾
Why this is wrong here
Microsoft Defender for Cloud Apps is a cloud access security broker (CASB) focused on SaaS applications, not on monitoring Kubernetes cluster configurations or runtime threats like crypto-mining containers.
★ When this WOULD be the correct answer
A company wants to discover and control the use of shadow IT SaaS applications, enforce data loss prevention policies for cloud apps, and detect anomalous user behavior in Office 365 or other SaaS platforms.
Why candidates choose this
Candidates may confuse 'cloud apps' with 'cloud workloads' and think Defender for Cloud Apps covers all cloud security, including Kubernetes, due to its broad name.
Analysis generated from the official SC-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Privileged access
Privileged access is a special level of permission that allows a user or system to perform high-impact actions like installing software, changing system settings, or accessing sensitive data across an IT environment.
Key term
Microsoft Defender
Microsoft Defender is a suite of security products that protects devices, data, and identities from cyber threats like malware, phishing, and unauthorized access.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.