SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
A company wants to use Microsoft Intune to manage devices. Which TWO capabilities does Intune provide?
⚠ Common exam trap
Many candidates confuse Intune's compliance policies (which are device-focused) with cloud resource compliance (Option B), or mistakenly associate Intune with identity management (Option E) because it integrates with Microsoft Entra ID for authentication.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Mobile device management (MDM)
Microsoft Intune provides Mobile Device Management (MDM) capabilities, allowing administrators to enroll devices, enforce configuration policies, and remotely wipe corporate data. Option D is correct because Intune also provides Mobile Application Management (MAM), enabling control over app access and data protection without requiring full device enrollment, using app protection policies.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Mobile device management (MDM)
Why this is correct
Microsoft Intune's Mobile Device Management (MDM) capabilities are fundamental for organizations to enroll, configure, and secure a diverse range of corporate and personal devices, including Windows, iOS/iPadOS, Android, and macOS. This core feature enables the enforcement of device-level security policies, deployment of settings and certificates, and remote actions like wiping or locking, ensuring devices meet organizational compliance before accessing sensitive resources.
- ✗
Compliance assessment for cloud resources
Why it's wrong here
Compliance assessment for cloud resources is not a primary function of Microsoft Intune. While Intune ensures the compliance of endpoints and applications, the continuous monitoring, security posture management, and regulatory compliance assessments for cloud infrastructure components, such as Azure virtual machines or storage accounts, are handled by Microsoft Defender for Cloud.
- ✗
Endpoint detection and response
Why it's wrong here
Endpoint detection and response (EDR) is not a capability provided by Microsoft Intune. Intune focuses on managing device configurations, deploying applications, and enforcing policies. Real-time monitoring of endpoint activities for malicious behavior, automated investigation, and advanced threat remediation are specialized functions performed by Microsoft Defender for Endpoint, a distinct security solution.
- ✓
Mobile application management (MAM)
Why this is correct
Microsoft Intune provides robust Mobile Application Management (MAM) capabilities, allowing organizations to manage and protect corporate data within specific applications, even on devices not fully enrolled in MDM. MAM policies control how corporate data is accessed, used, and shared within managed applications, enforcing data encryption, preventing data leakage to unmanaged apps, and requiring authentication without full device control.
- ✗
Identity and access management
Why it's wrong here
Identity and access management (IAM) is not directly provided by Microsoft Intune. While Intune integrates deeply with identity services to apply its management and compliance policies, the core functions of user authentication, authorization, single sign-on, and conditional access policy enforcement are the responsibility of Microsoft Entra ID (formerly Azure Active Directory), which serves as the central identity provider.
Go deeper
Related to this question
Learn chapter
Microsoft Entra ID
Key term
Bring Your Own Device
A policy allowing employees to use their personal laptops, smartphones, or tablets for work tasks instead of using company-issued equipment.
Key term
App protection policy
An app protection policy is a set of rules that controls how data is handled and secured within mobile applications, ensuring corporate information stays safe even on personal devices.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.