SC-900 Practice Question: Describe the concepts of security, compliance, and identity
A security analyst needs to investigate a potential ransomware attack affecting multiple endpoints. They want to centralize detection and response across devices, email, and applications. Which Microsoft solution should they use?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft 365 Defender (now Microsoft Defender XDR)
Microsoft Defender XDR (formerly Microsoft 365 Defender) provides unified detection and response across endpoints, email, identities, and applications. Microsoft Sentinel is a SIEM for broader security data. Defender for Cloud is for cloud workloads. Defender for Endpoint only covers endpoints.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Microsoft 365 Defender (now Microsoft Defender XDR)
Why this is correct
Microsoft Defender XDR (formerly Microsoft 365 Defender) is the correct choice because it provides extended detection and response capabilities across multiple security domains. It unifies signals from endpoints (Defender for Endpoint), email and collaboration (Defender for Office 365), identities (Defender for Identity), and cloud apps (Defender for Cloud Apps). This comprehensive correlation is crucial for investigating multi-stage attacks like ransomware, allowing analysts to trace the attack chain from initial compromise to impact across the entire Microsoft 365 ecosystem, offering a unified incident view.
- ✗
Microsoft Sentinel
Why it's wrong here
Microsoft Sentinel is a cloud-native Security Information and Event Management (SIEM) and Security Orchestration, Automation, and Response (SOAR) solution. While Sentinel can ingest security data and alerts from various sources, including Microsoft Defender products, it primarily focuses on centralized log collection, advanced threat hunting, and automated responses. It does not natively provide the integrated, real-time endpoint detection, email analysis, or identity protection capabilities required for a direct, unified ransomware investigation across these specific domains, acting more as an aggregator than a primary incident response tool.
- ✗
Microsoft Defender for Endpoint
Why it's wrong here
Microsoft Defender for Endpoint provides robust endpoint detection and response (EDR) capabilities, including threat prevention, post-breach detection, automated investigation, and response for devices. However, a comprehensive ransomware investigation often requires visibility beyond just endpoints. It would not natively provide the necessary insights into initial email vectors, compromised identities, or affected cloud applications, making it insufficient for a holistic understanding and response to a multi-stage ransomware attack that spans multiple attack surfaces.
- ✗
Microsoft Defender for Cloud
Why it's wrong here
Microsoft Defender for Cloud is designed to provide cloud security posture management (CSPM) and cloud workload protection (CWP) across multi-cloud and hybrid environments. Its primary focus is on securing Azure, AWS, and GCP resources, including virtual machines, containers, databases, and other cloud services. While it can detect threats within these cloud workloads, it does not offer integrated protection or investigation capabilities for email systems, on-premises endpoints, or the broader Microsoft 365 application ecosystem, which are critical components of a typical ransomware attack chain.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Defender for Endpoint
Microsoft Defender for Endpoint is a cloud-delivered enterprise security solution designed to protect devices from cyber threats using behavioral analysis, machine learning, and automated investigation.
Key term
Microsoft Sentinel
Microsoft Sentinel is a cloud-native security information and event management (SIEM) and security orchestration automation and response (SOAR) service that helps organizations detect, investigate, and respond to cyber threats across their entire digital estate.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.