SC-900 Practice Question: Describe the capabilities of Microsoft security solutions

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  A. Microsoft Defender for Endpoint

  Why it's wrong here

  Microsoft Defender for Endpoint is designed to provide endpoint detection and response (EDR), vulnerability management, and threat protection for operating systems and devices such as Windows, macOS, Linux servers, and mobile platforms. While it can protect the underlying host virtual machines of an AKS cluster, its primary function is not to scan container images stored in a registry for software vulnerabilities. It focuses on runtime protection and post-breach detection on the endpoint itself.

  When this WOULD be correct

  If the question asked for a solution to protect endpoints (e.g., detect and respond to threats on servers or client devices) and included scenarios like malware detection or attack surface reduction, Defender for Endpoint would be correct.

• ✗

  B. Microsoft Defender for Identity

  Why it's wrong here

  Microsoft Defender for Identity is a cloud-based security solution that leverages on-premises Active Directory signals to identify, detect, and investigate advanced threats, compromised identities, and malicious insider actions. Its core purpose is to protect user identities and credentials across hybrid environments by monitoring domain controllers and AD FS. It does not possess capabilities for scanning container images for software vulnerabilities or securing cloud-native container workloads.

  When this WOULD be correct

  A question asks: 'Which Microsoft security solution monitors and alerts on suspicious user activities and potential identity compromise in an on-premises Active Directory environment?'

• ✓

  C. Microsoft Defender for Cloud

  Why this is correct

  Microsoft Defender for Cloud is the correct solution as it provides comprehensive cloud security posture management (CSPM) and cloud workload protection (CWP). Specifically, its Defender for Containers plan integrates with Azure Container Registry (ACR) and Azure Kubernetes Service (AKS) to automatically scan container images for known vulnerabilities upon push, during import, or on a recurring basis. It identifies security misconfigurations and provides actionable remediation recommendations, crucial for securing containerized applications running on Azure Kubernetes.

• ✗

  D. Microsoft Defender for Office 365

  Why it's wrong here

  Microsoft Defender for Office 365 is a specialized security service focused on protecting an organization's email, data, and collaboration tools within the Microsoft 365 suite. It provides advanced threat protection against phishing, spam, malware, and business email compromise across Exchange Online, SharePoint Online, OneDrive for Business, and Microsoft Teams. This solution is entirely unrelated to securing container images or managing the security posture of Azure Kubernetes Service environments.

  When this WOULD be correct

  An exam question asking which Microsoft security solution protects against malicious links and attachments in email messages or SharePoint files, or provides anti-phishing policies for Exchange Online.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SC-900 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official SC-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question