SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
A company uses a mix of Azure virtual machines and on-premises Windows and Linux servers. The security team wants a single, integrated solution that can continuously assess these servers for missing security updates, weak operating system configurations, and common vulnerabilities. The solution should provide prioritized remediation recommendations. Which Microsoft security solution should they use?
⚠ Common exam trap
A common mix-up: candidates confuse Microsoft Defender for Cloud (a workload protection and compliance tool) with Microsoft 365 Defender (an endpoint and identity protection suite), leading them to choose the broader-sounding but incorrect option for a specific vulnerability assessment requirement.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Defender for Cloud
Microsoft Defender for Cloud provides a unified infrastructure security management solution that continuously assesses hybrid workloads, including Azure VMs and on-premises Windows/Linux servers. It integrates with Azure Policy and Microsoft Defender Vulnerability Management to detect missing security updates, weak OS configurations, and common vulnerabilities, then delivers prioritized remediation recommendations based on risk scores.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Microsoft Defender for Cloud
Why this is correct
Microsoft Defender for Cloud is the correct solution as it provides comprehensive security posture management and threat protection across hybrid and multi-cloud environments. It natively performs vulnerability assessments for Azure virtual machines and on-premises servers, integrating with Azure Arc to extend its capabilities. This service offers continuous monitoring, security recommendations, and compliance management, directly addressing the need for OS-level vulnerability scanning and configuration recommendations.
- ✗
Microsoft Sentinel
Why it's wrong here
Microsoft Sentinel is a cloud-native Security Information and Event Management (SIEM) and Security Orchestration, Automation, and Response (SOAR) platform. Its primary role is to collect security data from various sources, detect threats, investigate incidents, and automate responses. While Sentinel can ingest and analyze vulnerability data from other security tools, it does not natively perform active vulnerability scanning of server operating systems itself.
When this WOULD be correct
A question asking for a cloud-native SIEM that collects security data from across the enterprise (including multi-cloud and on-premises) to detect, investigate, and respond to threats would make Sentinel the correct answer.
- ✗
Microsoft Defender for Identity
Why it's wrong here
Microsoft Defender for Identity is specifically designed for identity-based threat detection and investigation, focusing on protecting Active Directory users and entities. It monitors network traffic and directory events to identify suspicious activities and attacks targeting identities. This solution does not perform operating system-level vulnerability scanning or provide recommendations for server patching and configuration, making it unsuitable for the stated requirement.
When this WOULD be correct
A question asking for a solution that monitors and protects on-premises Active Directory environments from advanced identity attacks, such as pass-the-hash or lateral movement, using behavioral analytics and alerts.
- ✗
Microsoft 365 Defender
Why it's wrong here
Microsoft 365 Defender is an Extended Detection and Response (XDR) solution that unifies protection across endpoints, email, identity, and cloud apps within the Microsoft 365 ecosystem. While it includes capabilities like Defender for Endpoint, its primary function is to correlate signals and automate responses to sophisticated attacks across these domains. It does not directly provide comprehensive, proactive server operating system vulnerability scanning for hybrid environments as its core offering.
When this WOULD be correct
A company wants a unified security solution to detect, investigate, and respond to advanced threats across their Microsoft 365 environment, including email, endpoints, and identities, with automated incident response and threat hunting capabilities.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SC-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Microsoft Defender for CloudCorrect answer▾
Why this is correct
Microsoft Defender for Cloud is the correct solution as it provides comprehensive security posture management and threat protection across hybrid and multi-cloud environments. It natively performs vulnerability assessments for Azure virtual machines and on-premises servers, integrating with Azure Arc to extend its capabilities. This service offers continuous monitoring, security recommendations, and compliance management, directly addressing the need for OS-level vulnerability scanning and configuration recommendations.
✗Microsoft SentinelWrong answer — click to see why▾
Why this is wrong here
Microsoft Sentinel is a SIEM/SOAR solution for security analytics and threat intelligence, not a continuous server assessment tool for missing updates, weak configurations, and vulnerabilities.
★ When this WOULD be the correct answer
A question asking for a cloud-native SIEM that collects security data from across the enterprise (including multi-cloud and on-premises) to detect, investigate, and respond to threats would make Sentinel the correct answer.
Why candidates choose this
Candidates may confuse Sentinel's log collection and alerting capabilities with the continuous assessment and remediation features of Defender for Cloud, especially since both involve security monitoring.
✗Microsoft Defender for IdentityWrong answer — click to see why▾
Why this is wrong here
Microsoft Defender for Identity focuses on detecting identity-based threats using Active Directory signals, not on assessing servers for missing updates, weak OS configurations, or vulnerabilities across hybrid environments.
★ When this WOULD be the correct answer
A question asking for a solution that monitors and protects on-premises Active Directory environments from advanced identity attacks, such as pass-the-hash or lateral movement, using behavioral analytics and alerts.
Why candidates choose this
Candidates may confuse 'Defender for Identity' with a general security solution for servers, misinterpreting its name as covering all security aspects rather than just identity protection.
✗Microsoft 365 DefenderWrong answer — click to see why▾
Why this is wrong here
Microsoft 365 Defender is designed to protect endpoints, identities, email, and applications within the Microsoft 365 ecosystem, but it does not provide continuous assessment of on-premises servers for missing security updates, weak OS configurations, or common vulnerabilities across hybrid environments.
★ When this WOULD be the correct answer
A company wants a unified security solution to detect, investigate, and respond to advanced threats across their Microsoft 365 environment, including email, endpoints, and identities, with automated incident response and threat hunting capabilities.
Why candidates choose this
Candidates may assume that 'Defender' products all offer similar vulnerability assessment capabilities, or they may confuse Microsoft 365 Defender's broader threat protection with the specific continuous assessment features of Defender for Cloud.
Analysis generated from the official SC-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Risk
Risk is the possibility that an event or action will negatively affect an organization's ability to achieve its goals, often measured in terms of likelihood and impact.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.