SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
A company uses Azure virtual machines and also has physical servers in their on-premises datacenter. The security team needs a single dashboard to view security recommendations, detect misconfigurations, and get a secure score for both environments. They also want to integrate with Microsoft Defender for Cloud for threat protection. Which Microsoft security solution provides this unified visibility across hybrid workloads?
⚠ Common exam trap
Microsoft often tests the distinction between Microsoft Defender for Cloud (unified posture management and threat protection) and Microsoft Sentinel (SIEM/SOAR), causing candidates to confuse the two due to overlapping security monitoring capabilities.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Defender for Cloud
Microsoft Defender for Cloud provides a unified dashboard that delivers security recommendations, misconfiguration detection, and a secure score across both Azure virtual machines and on-premises physical servers. It natively integrates with Microsoft Defender for Cloud's threat protection capabilities, enabling hybrid workload coverage without additional licensing or complex setup.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Microsoft Defender for Cloud
Why this is correct
Microsoft Defender for Cloud is the unified solution for comprehensive security posture management and integrated threat protection across hybrid and multi-cloud environments. It provides a secure score, actionable recommendations to harden Azure virtual machines and on-premises physical servers, and advanced threat protection capabilities. This platform ensures consistent security policies and visibility for both cloud-native and hybrid workloads, making it ideal for managing security across diverse infrastructure.
- ✗
Microsoft Sentinel
Why it's wrong here
Microsoft Sentinel is a cloud-native Security Information and Event Management (SIEM) and Security Orchestration, Automation, and Response (SOAR) solution. Its core function is to aggregate security data from various sources, detect threats using analytics and machine learning, and automate responses. However, Sentinel does not natively generate secure scores or provide specific configuration recommendations for hardening Azure VMs or physical servers; instead, it consumes security alerts and logs from services like Defender for Cloud for analysis and incident management.
When this WOULD be correct
A company needs to collect and analyze security logs from multiple sources (e.g., Azure, on-premises, other clouds) to detect advanced threats, investigate incidents, and automate responses. The question would ask for a SIEM solution that provides threat hunting and incident response across the enterprise.
- ✗
Microsoft Defender for Endpoint
Why it's wrong here
Microsoft Defender for Endpoint is a robust endpoint detection and response (EDR) solution specifically designed to protect devices like workstations and servers from advanced threats. While it provides deep visibility into endpoint activities, vulnerability management, and proactive threat hunting, its primary focus is on the security of individual endpoints rather than providing a holistic, secure score-driven posture management across an entire hybrid infrastructure. It does not offer the broad security recommendations for cloud and on-premises servers that Defender for Cloud does.
When this WOULD be correct
A question asking: 'Which Microsoft solution provides endpoint detection and response (EDR) capabilities for Windows, macOS, and Linux devices, and integrates with Microsoft Defender for Cloud for threat protection?' would make Defender for Endpoint correct.
- ✗
Microsoft Security Center
Why it's wrong here
Microsoft Security Center was the previous branding for the service now known as Microsoft Defender for Cloud. While it offered similar capabilities for security posture management and threat protection, it has been deprecated and fully rebranded. Selecting Microsoft Security Center indicates an outdated understanding of Microsoft's current security service offerings, as all new features, updates, and the current unified portal are released under the Microsoft Defender for Cloud umbrella.
When this WOULD be correct
A question might ask: 'Which legacy Azure security portal provided a unified view of security policies and recommendations across Azure resources before being rebranded?' In that context, Microsoft Security Center would be the correct answer.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SC-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Microsoft Defender for CloudCorrect answer▾
Why this is correct
Microsoft Defender for Cloud is the unified solution for comprehensive security posture management and integrated threat protection across hybrid and multi-cloud environments. It provides a secure score, actionable recommendations to harden Azure virtual machines and on-premises physical servers, and advanced threat protection capabilities. This platform ensures consistent security policies and visibility for both cloud-native and hybrid workloads, making it ideal for managing security across diverse infrastructure.
✗Microsoft SentinelWrong answer — click to see why▾
Why this is wrong here
Microsoft Sentinel is a SIEM/SOAR solution for security analytics and threat intelligence, not a dashboard for security recommendations, misconfiguration detection, and secure score across hybrid workloads. The question specifically asks for unified visibility and secure score, which is provided by Defender for Cloud.
★ When this WOULD be the correct answer
A company needs to collect and analyze security logs from multiple sources (e.g., Azure, on-premises, other clouds) to detect advanced threats, investigate incidents, and automate responses. The question would ask for a SIEM solution that provides threat hunting and incident response across the enterprise.
Why candidates choose this
Candidates may confuse Microsoft Sentinel with Defender for Cloud because both deal with security monitoring and threat protection, and Sentinel also integrates with Defender for Cloud. However, Sentinel focuses on log analysis and incident response, not on providing a secure score or compliance dashboard.
✗Microsoft Defender for EndpointWrong answer — click to see why▾
Why this is wrong here
Microsoft Defender for Endpoint focuses on endpoint protection (antivirus, EDR) for devices, not on providing a unified dashboard with security recommendations, misconfiguration detection, and secure score for hybrid workloads including Azure VMs and on-premises servers.
★ When this WOULD be the correct answer
A question asking: 'Which Microsoft solution provides endpoint detection and response (EDR) capabilities for Windows, macOS, and Linux devices, and integrates with Microsoft Defender for Cloud for threat protection?' would make Defender for Endpoint correct.
Why candidates choose this
Candidates may confuse Defender for Endpoint with Defender for Cloud because both have 'Defender' in the name and relate to security, but they serve different scopes—endpoint vs. cloud workload protection.
✗Microsoft Security CenterWrong answer — click to see why▾
Why this is wrong here
Microsoft Security Center is a legacy name for what is now Microsoft Defender for Cloud. The question asks for the current solution that provides unified visibility across hybrid workloads, and the correct name is Microsoft Defender for Cloud, not Security Center.
★ When this WOULD be the correct answer
A question might ask: 'Which legacy Azure security portal provided a unified view of security policies and recommendations across Azure resources before being rebranded?' In that context, Microsoft Security Center would be the correct answer.
Why candidates choose this
Candidates may recall the older name 'Microsoft Security Center' and not realize it has been rebranded to Microsoft Defender for Cloud, leading them to select the familiar but outdated term.
Analysis generated from the official SC-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Defender for Cloud
Microsoft Defender for Cloud is a cloud security posture management (CSPM) and cloud workload protection platform (CWPP) that provides unified security management and threat protection across hybrid and multi-cloud environments.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.