SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
A security analyst needs to detect and investigate compromised identities in on-premises Active Directory. They want to monitor for lateral movement, reconnaissance, and credential theft using behavioral analytics. Which Microsoft security solution is designed specifically for this purpose?
⚠ Common exam trap
Many exam-takers confuse Microsoft Defender for Identity with Microsoft Sentinel, assuming Sentinel's SIEM capabilities automatically cover identity-based behavioral analytics, but Sentinel lacks the native, agentless Active Directory behavioral profiling that MDI provides.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Defender for Identity
Microsoft Defender for Identity (MDI) is a cloud-based security solution that leverages on-premises Active Directory signals to identify, detect, and investigate advanced threats like lateral movement, reconnaissance, and credential theft. It uses behavioral analytics and machine learning to profile user and entity behavior, alerting on suspicious activities such as Pass-the-Hash, DCSync, and Kerberoasting without requiring agents on domain controllers.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Defender for Office 365
Why it's wrong here
Microsoft Defender for Office 365 is specifically engineered to safeguard an organization's email, links, and collaboration tools within the Microsoft 365 ecosystem. It provides advanced protection against phishing, malware, business email compromise, and other content-based threats targeting Exchange Online, SharePoint, OneDrive, and Teams. However, it lacks the specialized sensors and behavioral analytics necessary to detect and investigate identity-based attacks originating from or targeting on-premises Active Directory environments.
- ✗
Microsoft Defender for Cloud
Why it's wrong here
Microsoft Defender for Cloud offers comprehensive security posture management (CSPM) and cloud workload protection (CWP) across multi-cloud and hybrid environments. It provides recommendations, vulnerability assessments, and threat detection for cloud resources like virtual machines, containers, and databases. While it secures cloud identities and access, it is not designed with the specific deep protocol inspection and behavioral analysis capabilities required to monitor and detect sophisticated identity-based attacks within on-premises Active Directory domains.
- ✓
Microsoft Defender for Identity
Why this is correct
Microsoft Defender for Identity is the dedicated solution for detecting and investigating advanced threats and compromised identities within on-premises Active Directory environments. It deploys lightweight sensors directly on domain controllers to monitor network traffic and Windows events, leveraging behavioral analytics and machine learning to identify suspicious activities. This allows it to detect attack patterns such as lateral movement, credential theft, reconnaissance, and other indicators of compromise targeting on-premises user accounts and domain infrastructure.
- ✗
Microsoft Sentinel
Why it's wrong here
Microsoft Sentinel is a cloud-native Security Information and Event Management (SIEM) and Security Orchestration, Automation, and Response (SOAR) platform. It excels at collecting security data from diverse sources, including on-premises Active Directory logs, cloud services, and other security solutions, for centralized analysis, correlation, and custom rule-based detection. While Sentinel can ingest data from Defender for Identity or raw AD logs, it functions as an aggregation and analytics platform rather than providing the specialized, built-in behavioral detection engine for on-premises identity threats that Defender for Identity offers out-of-the-box.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Microsoft Defender
Microsoft Defender is a suite of security products that protects devices, data, and identities from cyber threats like malware, phishing, and unauthorized access.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.