SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
A company uses Microsoft 365 and needs to protect endpoints from ransomware attacks that encrypt files. The security team wants automated investigation and response capabilities for malware incidents on Windows devices. Which Microsoft security solution should they use?
⚠ Common exam trap
Many candidates confuse Microsoft Defender for Office 365 (which protects email and collaboration) with endpoint protection, failing to recognize that automated investigation and response for Windows devices specifically requires an endpoint-focused solution like Microsoft Defender for Endpoint.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Defender for Endpoint
Microsoft Defender for Endpoint (D) is the correct answer because it provides endpoint detection and response (EDR) capabilities, including automated investigation and remediation for malware incidents on Windows devices. It uses behavioral sensors, cloud analytics, and threat intelligence to detect ransomware encryption behavior and automatically contain or remediate affected endpoints, aligning with the requirement for automated response.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Defender for Office 365
Why it's wrong here
Microsoft Defender for Office 365 is specifically engineered to protect an organization's email, Microsoft Teams, SharePoint Online, and OneDrive for Business from advanced threats. It provides robust protection against phishing, malware, spam, and business email compromise by analyzing attachments and links. However, its scope is limited to content and communication within these services and does not extend to securing the operating system or applications on endpoint devices themselves.
- ✗
Microsoft Defender for Cloud Apps
Why it's wrong here
Microsoft Defender for Cloud Apps functions as a Cloud Access Security Broker (CASB), offering comprehensive visibility and control over an organization's cloud applications and services. It helps discover shadow IT, enforce data loss prevention policies, and identify anomalous user behavior across sanctioned and unsanctioned cloud apps. Its focus is on cloud app governance, data protection within those apps, and compliance, not on securing the physical endpoints accessing them.
- ✗
Microsoft Defender for Identity
Why it's wrong here
Microsoft Defender for Identity is designed to protect hybrid identity environments by monitoring signals from on-premises Active Directory and Azure Active Directory. It detects, investigates, and helps remediate advanced identity-based threats such as credential theft, pass-the-hash attacks, and lateral movement. This service focuses on securing user identities and their access privileges, rather than providing antivirus or endpoint detection and response for devices.
- ✓
Microsoft Defender for Endpoint
Why this is correct
Microsoft Defender for Endpoint delivers a comprehensive endpoint security solution for devices across various platforms, including Windows, macOS, Linux, Android, and iOS. It integrates next-generation antivirus, Endpoint Detection and Response (EDR) capabilities, automated investigation and remediation, and vulnerability management to proactively protect against and respond to sophisticated threats. This service is specifically engineered to secure endpoints from malware, exploits, and other malicious activities, making it the correct choice for device protection.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Microsoft Defender for Endpoint
Microsoft Defender for Endpoint is a cloud-delivered enterprise-grade security platform that protects devices, servers, and networks from advanced cyber threats by combining antivirus, endpoint detection and response, and automated investigation and remediation.
Key term
Malware
Malware is any software intentionally designed to cause damage, disrupt operations, steal data, or gain unauthorized access to computer systems.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.