SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
A company uses Azure resources, on-premises servers, and third-party cloud apps. The security team wants a single solution to collect security logs from all these sources, detect threats using advanced analytics, and automate responses to incidents. Which Microsoft security solution should they use?
⚠ Common exam trap
Candidates often confuse Microsoft Defender for Cloud (a CSPM tool) with a SIEM solution, failing to recognize that Sentinel is the only Microsoft service designed specifically for cross-source log aggregation, advanced threat detection, and automated incident response in a hybrid multi-cloud environment.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
C
A cloud-native SIEM and SOAR solution that can ingest logs from Azure resources, on-premises servers, and third-party cloud apps. It uses advanced analytics with built-in machine learning to detect threats and supports automated incident response. The other options represent different Microsoft security tools that lack the full SIEM/SOAR capabilities required for this scenario.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A
Why it's wrong here
Microsoft Defender for Cloud provides security posture management and threat protection for cloud workloads, but it is not a centralized SIEM for multi-environment log aggregation.
- ✗
B
Why it's wrong here
Microsoft Defender for Identity is focused on detecting threats in on-premises Active Directory using signals from domain controllers, not a multi-source SIEM.
- ✓
C
Why this is correct
Correct. Microsoft Sentinel is designed to ingest logs from multiple sources, provide threat detection via analytics, and automate responses.
- ✗
D
Why it's wrong here
Microsoft Defender for Cloud Apps is a Cloud Access Security Broker (CASB) that protects cloud apps, but it does not aggregate on-premises server logs.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Incident response
Incident response is the structured approach an organization uses to identify, contain, and recover from cybersecurity incidents like data breaches or ransomware attacks.
Key term
SOAR
SOAR (Security Orchestration, Automation, and Response) is a technology stack that helps security teams automate responses to threats by integrating various security tools and standardizing workflows.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.