SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
A company uses Microsoft Sentinel for security information and event management (SIEM). The security team needs to detect and automatically respond to a potential privilege escalation attack where an attacker attempts to add a new user to the Global Administrator role in Microsoft Entra ID. What should the security team configure?
⚠ Common exam trap
Watch out — candidates often confuse Microsoft Sentinel's SIEM capabilities with Microsoft Defender for Cloud Apps' CASB features, but Sentinel is the only option that provides custom analytics rules with integrated automated playbooks for SIEM-based detection and response.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create an analytics rule with an automated playbook in Microsoft Sentinel
Microsoft Sentinel is the SIEM solution, and analytics rules define conditions that trigger automated responses. By creating an analytics rule that detects a user being added to the Global Administrator role (e.g., via the AuditLogs or IdentityProtection logs) and linking it to an automated playbook (a logic app), the security team can automatically respond to the privilege escalation attempt without manual intervention.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Deploy a device compliance policy in Microsoft Intune
Why it's wrong here
Microsoft Intune is primarily a mobile device management (MDM) and mobile application management (MAM) solution. Device compliance policies in Intune define security requirements for endpoints, such as requiring a minimum OS version, disk encryption, or ensuring devices are not jailbroken. While essential for endpoint security posture, Intune does not monitor or respond to changes in Microsoft Entra ID (formerly Azure AD) identity roles or security events related to user accounts themselves. Therefore, it cannot detect or remediate an identity-related security incident like an unauthorized role assignment.
- ✗
Configure a data classification label in Microsoft Purview
Why it's wrong here
Microsoft Purview is a unified data governance solution designed to help organizations manage and govern their data across various environments. Data classification labels within Purview are used to identify, categorize, and protect sensitive information, enabling policies for data loss prevention (DLP), retention, and encryption. This functionality focuses on protecting the content and lifecycle of data assets, not on real-time detection or automated response to identity-based security threats or changes in administrative roles within Microsoft Entra ID.
- ✗
Create a policy in Microsoft Defender for Cloud Apps
Why it's wrong here
Microsoft Defender for Cloud Apps (MDCA) functions as a Cloud Access Security Broker (CASB), providing visibility, control, and protection for cloud applications. It can detect anomalous behavior within connected applications, enforce access policies, and prevent data exfiltration by monitoring user activity *within* those apps. However, MDCA's primary focus is not on detecting or responding to direct changes in Microsoft Entra ID administrative roles or broader identity infrastructure events, as it operates at the application layer rather than the core identity provider layer for such specific role changes.
- ✓
Create an analytics rule with an automated playbook in Microsoft Sentinel
Why this is correct
Microsoft Sentinel is a cloud-native Security Information and Event Management (SIEM) and Security Orchestration, Automation, and Response (SOAR) solution. It ingests security logs from various sources, including Microsoft Entra ID audit logs, to detect threats using analytics rules defined with Kusto Query Language (KQL). An analytics rule can identify specific events, such as unauthorized role assignments, and then trigger an automated playbook (built with Azure Logic Apps) to perform immediate response actions like revoking a role, isolating a user, or sending notifications, directly addressing the need for detection and automated response to identity-related security incidents.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
SIEM
SIEM (Security Information and Event Management) is a system that collects and analyzes log data from across an IT environment to detect and respond to security threats in real time.
Key term
User
A user is any person, system, or device that interacts with an IT service, resource, or identity system, typically authenticated through credentials and authorized to perform specific actions.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.