SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
A company uses Microsoft 365 and wants to deploy a security solution that can automatically detect and remediate advanced attacks on endpoints (workstations and servers), such as ransomware and fileless attacks. They also want to provide incident response teams with detailed forensic data and the ability to isolate an infected machine from the network. Which Microsoft security solution should they use?
⚠ Common exam trap
A common mix-up: candidates confuse the endpoint-focused capabilities of Microsoft Defender for Endpoint with the email/identity/cloud-specific scopes of the other Defender products, failing to recognize that only MDE provides automated endpoint remediation and network isolation for workstations and servers.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Defender for Endpoint
Microsoft Defender for Endpoint (MDE) is the correct solution because it provides endpoint detection and response (EDR) capabilities, including automatic detection and remediation of advanced attacks like ransomware and fileless attacks. It also offers detailed forensic data for incident response and the ability to isolate an infected machine from the network, meeting all the specified requirements.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Defender for Office 365
Why it's wrong here
Microsoft Defender for Office 365 primarily safeguards an organization's email, Microsoft Teams, SharePoint, and OneDrive environments. It provides advanced protection against phishing, spam, malware, and business email compromise by leveraging Safe Attachments and Safe Links technologies. While crucial for securing collaboration platforms, it does not extend its protective capabilities to individual user devices or endpoints, which are the focus of this question.
- ✓
Microsoft Defender for Endpoint
Why this is correct
Microsoft Defender for Endpoint is a comprehensive enterprise endpoint security platform designed to protect devices from advanced threats. It offers Endpoint Detection and Response (EDR) capabilities, next-generation protection, attack surface reduction, and automated investigation and remediation. This solution actively monitors endpoints for malicious activity, isolates compromised devices, and provides a unified view of security incidents across an organization's device fleet, making it ideal for endpoint deployment.
- ✗
Microsoft Defender for Identity
Why it's wrong here
Microsoft Defender for Identity focuses on identifying, detecting, and investigating advanced threats, compromised identities, and malicious insider actions directed at an organization's on-premises Active Directory and hybrid identity infrastructure. It monitors network traffic and security events from domain controllers to detect suspicious user and entity behavior analytics (UEBA) and known attack techniques. This solution provides visibility into identity-based attacks but does not directly secure individual endpoints.
- ✗
Microsoft Defender for Cloud Apps
Why it's wrong here
Microsoft Defender for Cloud Apps functions as a Cloud Access Security Broker (CASB), providing comprehensive visibility, control, and protection for an organization's cloud applications and data. It helps discover shadow IT, enforce data loss prevention (DLP) policies, and protect sensitive information across sanctioned and unsanctioned cloud services. Its primary role is to manage and secure cloud app usage, rather than providing direct security for endpoint devices.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Endpoint detection and response
Endpoint detection and response (EDR) is a cybersecurity solution that continuously monitors endpoint devices for suspicious activity and automatically responds to threats to stop attacks in real time.
Key term
Defender for Endpoint
Microsoft Defender for Endpoint is a cloud-delivered enterprise security solution designed to protect devices from cyber threats using behavioral analysis, machine learning, and automated investigation.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.