SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
A company uses Microsoft Defender for Endpoint to secure its devices, Microsoft Defender for Office 365 for email security, and Microsoft Defender for Identity for on-premises Active Directory. The security team wants a single console to view correlated incidents across these domains, where an incident might combine a suspicious email, a malicious file download, and a compromised account. Which Microsoft solution provides this unified incident view and automatic correlation?
⚠ Common exam trap
Test-takers frequently confuse Microsoft Sentinel (a SIEM) with Microsoft 365 Defender (an XDR), mistakenly thinking Sentinel provides the same out-of-the-box cross-domain correlation, when in fact Sentinel requires manual configuration and is not the single console for native Defender product integration.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft 365 Defender (now Microsoft Defender XDR)
Microsoft 365 Defender (now Microsoft Defender XDR) is the correct answer because it provides a unified incident view across Microsoft Defender for Endpoint, Defender for Office 365, and Defender for Identity. It automatically correlates alerts from these domains—such as a suspicious email, a malicious file download, and a compromised account—into a single incident, enabling security teams to investigate and respond from one console.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Sentinel
Why it's wrong here
Microsoft Sentinel is a cloud-native Security Information and Event Management (SIEM) and Security Orchestration, Automation, and Response (SOAR) solution. While it ingests security data from various sources, including Microsoft Defender products, it primarily focuses on enterprise-wide log aggregation, custom threat detection, and automated response across diverse environments. It does not offer the inherent, out-of-the-box incident correlation and unified investigation experience across the specific Microsoft Defender suite pillars that Defender XDR provides.
- ✗
Microsoft Defender for Cloud
Why it's wrong here
Microsoft Defender for Cloud is primarily designed for Cloud Security Posture Management (CSPM) and Cloud Workload Protection (CWP) across multi-cloud and hybrid environments. It secures IaaS, PaaS, and server workloads by identifying vulnerabilities and providing threat protection for cloud resources. However, it does not natively integrate and correlate security incidents spanning endpoints, email, and identity services into a single, unified incident view, which is a core function of an XDR solution.
- ✓
Microsoft 365 Defender (now Microsoft Defender XDR)
Why this is correct
Microsoft Defender XDR (formerly Microsoft 365 Defender) is a unified pre- and post-breach enterprise defense suite that natively integrates and orchestrates detection, investigation, and response. It automatically correlates alerts and signals from its constituent services—Defender for Endpoint, Defender for Identity, Defender for Office 365, and Defender for Cloud Apps—into cohesive incidents. This comprehensive integration provides a holistic view of attacks and streamlines the security operations center (SOC) workflow from a single, centralized portal.
- ✗
Microsoft Purview Compliance Portal
Why it's wrong here
The Microsoft Purview Compliance Portal offers a suite of solutions focused on data governance, data protection, and risk management across an organization's data estate. Its capabilities include data classification, data loss prevention (DLP), eDiscovery, and insider risk management to help meet compliance obligations. However, Purview is not designed for real-time security incident correlation across endpoint, identity, and email threats, nor does it provide the unified security operations console for active threat investigation and response.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Defender for Endpoint
Microsoft Defender for Endpoint is a cloud-delivered enterprise security solution designed to protect devices from cyber threats using behavioral analysis, machine learning, and automated investigation.
Key term
Defender for Identity
Defender for Identity is a cloud-based security solution that detects, investigates, and responds to advanced identity threats targeting on-premises Active Directory and cloud identities.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.