SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
A company uses Microsoft 365 and wants to protect against phishing attacks that impersonate their executives. They need a solution that uses machine learning to analyze email patterns and provide real-time protection. Which Microsoft 365 service should they use?
⚠ Common exam trap
Test-takers frequently confuse email protection with data loss prevention or identity protection, which are separate services in Microsoft 365.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Defender for Office 365
Microsoft Defender for Office 365 includes anti-phishing policies that use machine learning to detect impersonation attempts, including executive impersonation. It provides real-time protection for email. The other options serve different purposes: DLP for data protection, Defender for Identity for on-premises identity threats, and Defender for Cloud Apps for cloud app security.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Microsoft Defender for Office 365
Why this is correct
Microsoft Defender for Office 365 provides advanced threat protection for email and collaboration tools. It includes anti-phishing policies that use machine learning and impersonation detection to protect against executive impersonation. This directly addresses the requirement for real-time protection against phishing attacks targeting executives.
- ✗
Microsoft Defender for Cloud Apps
Why it's wrong here
Microsoft Defender for Cloud Apps is a Cloud Access Security Broker (CASB) that provides visibility and control over cloud apps. It can detect anomalous behavior but is not primarily an email anti-phishing solution. It does not use machine learning to analyze email patterns for impersonation protection.
- ✗
Microsoft Purview Data Loss Prevention
Why it's wrong here
Microsoft Purview Data Loss Prevention (DLP) is designed to prevent sensitive data from being shared inappropriately. It does not focus on phishing or impersonation attacks. While it can protect data, it is not the right tool for detecting and blocking phishing emails that impersonate executives.
- ✗
Microsoft Defender for Identity
Why it's wrong here
Microsoft Defender for Identity monitors on-premises Active Directory to detect identity-based threats. It does not provide email protection or anti-phishing capabilities. It is used for detecting attacks like Pass-the-Hash and reconnaissance, not for securing email against impersonation.
Go deeper
Related to this question
Learn chapter
Identity Governance in Microsoft Entra
Key term
Identity
Identity is the unique set of attributes that defines a user, device, or service in a computer system, determining what they can access and do.
Key term
Anti-phishing policy
An anti-phishing policy is a set of rules and technical controls that organizations use to detect, block, and respond to email or message-based attacks that trick users into revealing sensitive information.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,279 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.