SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
A company runs Windows Server virtual machines (VMs) on-premises and in Azure. The security team wants a unified view of missing security updates and known vulnerabilities (CVEs) across all VMs. They want to enable agentless scanning for Azure VMs and deploy a lightweight agent for on-premises machines. The results should be consolidated in a single dashboard with prioritized remediation recommendations. Which Microsoft security solution should they use?
⚠ Common exam trap
Test-takers frequently confuse Microsoft Defender for Cloud (a cloud security posture management and workload protection solution) with Microsoft Defender for Endpoint (an endpoint detection and response tool), assuming both provide identical vulnerability scanning capabilities, but only Defender for Cloud offers agentless scanning for Azure VMs and a unified hybrid dashboard for missing updates and CVEs.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Defender for Cloud
Microsoft Defender for Cloud provides unified visibility into security vulnerabilities and missing updates across hybrid workloads, including on-premises and Azure VMs. It supports agentless scanning for Azure VMs (using the cloud-based scanner) and allows deployment of the Azure Monitor Agent (or legacy Log Analytics agent) for on-premises machines, consolidating findings in a single dashboard with prioritized remediation recommendations based on the Secure Score and integrated vulnerability assessment (e.g., Qualys or Microsoft Defender Vulnerability Management).
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Microsoft Defender for Cloud
Why this is correct
Defender for Cloud includes vulnerability assessment capabilities that cover VMs in Azure and on-premises (via Azure Arc). It provides a single dashboard showing missing patches and CVEs with actionable recommendations, and supports both agentless and agent-based scanning.
- ✗
Microsoft Defender for Endpoint
Why it's wrong here
Defender for Endpoint offers vulnerability management for endpoints, but it is primarily focused on devices enrolled in Microsoft Intune or through Azure Arc for servers. However, the consolidated multi-environment dashboard for VM vulnerabilities is a primary function of Defender for Cloud, not Defender for Endpoint.
When this WOULD be correct
An organization needs a solution to detect, investigate, and respond to advanced threats on endpoints (e.g., workstations, servers, mobile devices) with real-time behavioral analytics and automated remediation, without requiring a separate cloud security posture management tool.
- ✗
Microsoft Sentinel
Why it's wrong here
Microsoft Sentinel functions as a cloud-native Security Information and Event Management (SIEM) and Security Orchestration, Automation, and Response (SOAR) solution. While it excels at ingesting security logs, alerts, and vulnerability assessment data from various sources, including Defender for Cloud, it does not inherently perform vulnerability scanning of virtual machines. Sentinel's primary role is threat detection, investigation, and automated response based on aggregated data, rather than actively identifying missing patches or CVEs on hosts.
When this WOULD be correct
A company needs to centralize security logs and alerts from multiple sources (e.g., firewalls, servers, cloud apps) and use advanced analytics to detect threats, with automated response playbooks. The question would ask for a cloud-native SIEM solution.
- ✗
Microsoft Defender for Identity
Why it's wrong here
Microsoft Defender for Identity (MDI) is specifically engineered to protect hybrid identity environments by monitoring Active Directory domain controllers and AD FS servers for suspicious user behavior and advanced attacks like credential theft or lateral movement. It analyzes network activity and event logs to detect threats targeting identities. However, MDI does not perform host-level vulnerability assessments or patch management for Windows Server VMs themselves, as its scope is identity-centric threat detection, not infrastructure vulnerability scanning.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SC-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Microsoft Defender for CloudCorrect answer▾
Why this is correct
Defender for Cloud includes vulnerability assessment capabilities that cover VMs in Azure and on-premises (via Azure Arc). It provides a single dashboard showing missing patches and CVEs with actionable recommendations, and supports both agentless and agent-based scanning.
✗Microsoft Defender for EndpointWrong answer — click to see why▾
Why this is wrong here
Microsoft Defender for Endpoint focuses on endpoint detection and response (EDR) for individual devices, not unified vulnerability assessment across on-premises and Azure VMs with agentless scanning and consolidated dashboard.
★ When this WOULD be the correct answer
An organization needs a solution to detect, investigate, and respond to advanced threats on endpoints (e.g., workstations, servers, mobile devices) with real-time behavioral analytics and automated remediation, without requiring a separate cloud security posture management tool.
Why candidates choose this
Candidates may confuse Defender for Endpoint's vulnerability management capabilities with the broader multi-cloud vulnerability assessment and compliance features of Defender for Cloud.
✗Microsoft SentinelWrong answer — click to see why▾
Why this is wrong here
Microsoft Sentinel is a SIEM/SOAR solution for security event collection and threat detection, not a vulnerability management tool. It lacks native agentless scanning for Azure VMs and a dedicated dashboard for missing security updates and CVEs with prioritized remediation.
★ When this WOULD be the correct answer
A company needs to centralize security logs and alerts from multiple sources (e.g., firewalls, servers, cloud apps) and use advanced analytics to detect threats, with automated response playbooks. The question would ask for a cloud-native SIEM solution.
Why candidates choose this
Candidates may confuse Sentinel's unified dashboard and log aggregation capabilities with vulnerability management, assuming it can consolidate update and CVE data when it's actually designed for threat detection and incident response.
Analysis generated from the official SC-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Secure Score
Secure Score is a measurement tool in Microsoft 365 that shows how secure your organization is based on the security features you have enabled and configured.
Key term
Vulnerability
A vulnerability is a weakness in a system, network, or software that could be exploited by a threat to cause harm or unauthorized access.
About these practice questions
This SC-900 question is part of Courseiva's 1,250-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.