SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
A company uses Azure virtual machines and on-premises Windows servers. The security team wants a single solution that provides vulnerability assessment, a regulatory compliance dashboard (e.g., for ISO 27001), and integrated threat detection such as fileless malware and anomalous logins. Which Microsoft security solution should they use?
⚠ Common exam trap
Many candidates confuse Microsoft Defender for Cloud with Microsoft 365 Defender, mistakenly thinking the latter covers all security workloads, but Microsoft 365 Defender is limited to Microsoft 365 services and does not manage Azure infrastructure or on-premises servers.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Defender for Cloud
Microsoft Defender for Cloud (formerly Azure Security Center and Azure Defender) is the correct choice because it provides unified security management across Azure VMs and on-premises servers. It includes built-in vulnerability assessment (via Qualys or Microsoft Defender Vulnerability Management), a regulatory compliance dashboard with built-in standards like ISO 27001, and integrated threat detection for fileless malware, anomalous logins, and other advanced attacks. This single solution meets all the requirements listed in the question.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Defender for Endpoint
Why it's wrong here
Microsoft Defender for Endpoint is a robust Endpoint Detection and Response (EDR) solution focused on protecting devices like workstations and servers from advanced threats. It provides vulnerability management, attack surface reduction, and automated investigation capabilities specifically for endpoints. However, it does not offer the broad cloud security posture management (CSPM) or regulatory compliance dashboards required for comprehensive oversight of Azure virtual machines and on-premises infrastructure workloads.
- ✓
Microsoft Defender for Cloud
Why this is correct
Microsoft Defender for Cloud provides comprehensive cloud security posture management (CSPM) and cloud workload protection (CWPP) across Azure, on-premises, and multi-cloud environments. It offers integrated vulnerability assessments, a secure score for continuous security posture improvement, and regulatory compliance dashboards to monitor adherence to industry standards. This service directly addresses the need for unified security management, threat protection, and compliance for both Azure virtual machines and on-premises Windows servers.
- ✗
Microsoft 365 Defender
Why it's wrong here
Microsoft 365 Defender is an extended detection and response (XDR) solution that unifies protection, detection, investigation, and response across Microsoft 365 services, including identities, endpoints, email, and cloud apps. While it integrates endpoint security via Defender for Endpoint, its primary focus is on the M365 ecosystem and user-centric threats. It does not provide the dedicated cloud infrastructure vulnerability assessments or the broad regulatory compliance dashboards for IaaS workloads and on-premises servers that Defender for Cloud offers.
- ✗
Microsoft Sentinel
Why it's wrong here
Microsoft Sentinel is a cloud-native Security Information and Event Management (SIEM) and Security Orchestration, Automation, and Response (SOAR) solution. Its core function is to collect security data from various sources, detect threats using analytics and machine learning, and enable automated responses. While Sentinel can ingest security logs from Azure and on-premises systems, it is not designed to provide built-in vulnerability assessments, secure score calculations, or proactive regulatory compliance dashboards for workload posture management.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Compliance
Compliance is the process of ensuring that an organization follows laws, regulations, standards, and internal policies that apply to its operations and data handling.
Key term
Vulnerability assessment
A vulnerability assessment is a systematic review of security weaknesses in an information system, evaluating if the system is susceptible to any known vulnerabilities, assigning severity levels, and recommending remediation or mitigation.
About these practice questions
This SC-900 question is part of Courseiva's 1,250-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.