SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
A security analyst needs to investigate a phishing campaign that targeted multiple users. They want to correlate email threat data with user actions and device signals. Which Microsoft security solution should they use as the primary investigation console?
⚠ Common exam trap
Candidates often choose Microsoft Defender for Office 365 because they focus on the 'phishing campaign' aspect, forgetting that the question specifically requires correlation with user actions and device signals, which only Microsoft 365 Defender provides as a unified console.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft 365 Defender
Microsoft 365 Defender (now Microsoft Defender XDR) is the correct choice because it provides a unified incident investigation and response experience that correlates signals across email, endpoints, identities, and cloud apps. For a phishing campaign targeting multiple users, the analyst needs to correlate email threat data (from Defender for Office 365) with user actions (from Azure AD/Identity) and device signals (from Defender for Endpoint) — this cross-domain correlation is the primary function of Microsoft 365 Defender's incident queue and advanced hunting.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Defender for Endpoint
Why it's wrong here
Microsoft Defender for Endpoint (MDE) is primarily designed for endpoint detection and response, focusing on devices like workstations and servers. While it can detect malicious payloads or activities originating from a phishing attack on an endpoint, it lacks native visibility into the email delivery process, user identity compromise, or the broader context of the phishing campaign's initial vector. Therefore, MDE alone cannot provide the comprehensive, cross-domain investigation required for a full phishing campaign analysis.
- ✗
Microsoft Defender for Office 365
Why it's wrong here
Microsoft Defender for Office 365 (MDO) specializes in protecting email and collaboration tools within the Office 365 environment, offering advanced anti-phishing, anti-spam, and anti-malware capabilities. While MDO is crucial for detecting and preventing phishing emails, its scope is limited to email and cloud apps, meaning it does not provide visibility into endpoint compromise or identity-related threats that might result from a successful phishing attempt. A complete investigation requires understanding the impact beyond the email gateway.
- ✓
Microsoft 365 Defender
Why this is correct
Microsoft 365 Defender is the unified XDR (eXtended Detection and Response) solution that integrates signals from Defender for Endpoint, Defender for Office 365, Defender for Identity, and Defender for Cloud Apps. This platform provides a holistic view, correlating alerts and incidents across email, endpoints, identities, and cloud applications. For a phishing campaign, it enables security analysts to trace the entire attack chain, from the initial email delivery and user interaction to potential endpoint compromise or identity theft, offering comprehensive investigation and response capabilities.
- ✗
Microsoft Sentinel
Why it's wrong here
Microsoft Sentinel is a cloud-native Security Information and Event Management (SIEM) and Security Orchestration, Automation, and Response (SOAR) solution. While Sentinel can ingest alerts and logs from all Defender products and perform cross-source correlation, it serves as an aggregation and orchestration platform rather than the native, deep-dive investigation console for Defender incidents. The specialized tools and contextual information needed for a detailed, cross-domain investigation of a phishing campaign, particularly regarding email, endpoint, and identity signals, are best accessed directly within the Microsoft 365 Defender portal.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
XDR
XDR, or Extended Detection and Response, is a unified security platform that collects and correlates data across multiple security layers—endpoints, networks, servers, cloud workloads, and email—to improve threat detection and enable faster response.
Key term
Office 365
Office 365 is a cloud-based subscription service from Microsoft that provides access to productivity applications like Word, Excel, and Outlook, along with other cloud services, for a monthly or annual fee.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.