SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
A company uses Microsoft 365 and wants to protect its users from malicious links and attachments in email, as well as phishing attacks. Which Microsoft security solution is specifically designed for email and collaboration protection?
⚠ Common exam trap
Candidates often confuse Microsoft Defender for Endpoint (device protection) with Microsoft Defender for Office 365 (email and collaboration protection), because both names start with 'Microsoft Defender' and both involve threat detection, but they protect completely different attack surfaces.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Defender for Office 365
Microsoft Defender for Office 365 (formerly Office 365 Advanced Threat Protection) is the dedicated security solution for email and collaboration workloads. It provides protection against malicious links (Safe Links), malicious attachments (Safe Attachments), and anti-phishing policies specifically for Exchange Online, SharePoint, OneDrive, and Teams. This directly matches the question's requirement for email and collaboration protection.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Defender for Endpoint
Why it's wrong here
Microsoft Defender for Endpoint provides advanced threat protection for devices, including prevention, post-breach detection, automated investigation, and response capabilities for endpoints like workstations, servers, and mobile devices. While it protects devices from threats that might originate from email, its primary function is not to scan email content for malicious links or attachments during mail flow, but rather to secure the device itself.
- ✓
Microsoft Defender for Office 365
Why this is correct
Microsoft Defender for Office 365 is specifically designed to protect Microsoft 365 services, including email, Teams, and SharePoint Online, from advanced threats. It provides robust capabilities like Safe Attachments, which detonates suspicious attachments in a sandbox environment, and Safe Links, which rewrites and scans URLs at the time of click to prevent access to malicious websites, directly addressing the need for protection against malicious links and attachments in email.
- ✗
Microsoft Defender for Cloud Apps
Why it's wrong here
Microsoft Defender for Cloud Apps functions as a Cloud Access Security Broker (CASB), offering comprehensive visibility, control, and threat protection across various cloud applications. Its capabilities include discovering shadow IT, enforcing data loss prevention policies, and detecting anomalous user behavior within cloud services. However, it does not directly scan incoming email for malicious links or attachments; its focus is on securing access to and data within sanctioned and unsanctioned cloud applications.
- ✗
Microsoft Defender for Identity
Why it's wrong here
Microsoft Defender for Identity protects on-premises Active Directory accounts and Kerberos authentication events, not email transport or link scanning; the stem specifically requires protection against malicious links and attachments in email, which is handled by Microsoft Defender for Office 365. It is tempting because its name includes “Identity,” suggesting user-focused security, and it would be correct for detecting compromised credentials or lateral movement in hybrid identity environments.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Threat protection
Threat protection is the set of security measures and technologies used to detect, prevent, and respond to cyberattacks and unauthorized access to systems and data.
Key term
Collaboration
Collaboration in Microsoft 365 refers to the integrated tools and services that enable people to work together in real time, share information, and coordinate tasks from anywhere.
About these practice questions
This SC-900 question is part of Courseiva's 1,250-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.