SC-900 Practice Question: Describe the capabilities of Microsoft security solutions

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Microsoft Defender for Cloud

  Why this is correct

  Microsoft Defender for Cloud is the correct solution because it provides comprehensive Cloud Security Posture Management (CSPM) and Cloud Workload Protection (CWP) across multi-cloud environments, including Azure, Amazon Web Services (AWS), and Google Cloud Platform (GCP). It centralizes security posture assessment, identifies misconfigurations, and offers prioritized recommendations for resources in both Azure and AWS from a single pane of glass, ensuring consistent security across the company's diverse infrastructure.

• ✗

  Microsoft Defender for Cloud Apps

  Why it's wrong here

  Microsoft Defender for Cloud Apps functions as a Cloud Access Security Broker (CASB), primarily focusing on discovering, monitoring, and controlling access to cloud applications (SaaS) and services, as well as protecting sensitive data within them. While crucial for application-level security and compliance, it does not provide native security posture management or threat protection for the underlying infrastructure and workloads running directly on IaaS platforms like Azure or AWS.

  When this WOULD be correct

  A company wants to discover and control the use of third-party SaaS applications (e.g., Dropbox, Salesforce) accessed by employees, enforce access policies, and detect anomalous behavior in cloud app usage. In that scenario, Microsoft Defender for Cloud Apps would be the correct solution.

• ✗

  Microsoft Sentinel

  Why it's wrong here

  Microsoft Sentinel is a cloud-native Security Information and Event Management (SIEM) and Security Orchestration, Automation, and Response (SOAR) solution. It aggregates security data from various sources, including cloud platforms, applications, and on-premises systems, to detect threats, investigate alerts, and automate responses. While it can ingest security findings from posture management tools, Sentinel itself does not natively perform the initial security posture assessment or configuration analysis of cloud environments like Azure or AWS.

  When this WOULD be correct

  A company needs a cloud-native SIEM to collect security data from all cloud environments, detect threats, and orchestrate automated responses across Azure, AWS, and GCP. The question emphasizes threat detection and incident response rather than posture management.

• ✗

  Microsoft Defender for Endpoint

  Why it's wrong here

  Microsoft Defender for Endpoint is an enterprise endpoint security platform designed to help organizations prevent, detect, investigate, and respond to advanced threats on devices such as workstations, servers, and mobile devices. Its core functionality revolves around Endpoint Detection and Response (EDR) and vulnerability management for operating systems, not assessing the security configurations or posture of cloud infrastructure services provided by Azure or AWS themselves.

  When this WOULD be correct

  A question asking for a solution to protect endpoints (e.g., laptops, servers) from threats like malware, with capabilities for endpoint detection and response (EDR), and integration with Microsoft 365 Defender.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SC-900 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official SC-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question