SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
A security operations center (SOC) receives a high volume of low-fidelity alerts from various security tools. They need a solution that can automatically correlate alerts into incidents, use built-in machine learning to reduce false positives, and provide a unified console for investigation and response across Azure, on-premises, and Microsoft 365. Which Microsoft security solution should they use?
⚠ Common exam trap
Test-takers frequently confuse Microsoft Defender for Cloud (a CSPM/CWPP) with a SIEM, or assume Defender for Endpoint can handle cross-environment correlation, when only Microsoft Sentinel provides the SIEM capabilities of alert aggregation, ML-based false-positive reduction, and a unified investigation console across Azure, on-premises, and Microsoft 365.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Sentinel
Microsoft Sentinel is a cloud-native SIEM (Security Information and Event Management) solution that ingests high-volume, low-fidelity alerts from multiple sources, correlates them into incidents using built-in analytics and machine learning, and provides a unified console for investigation and response across Azure, on-premises, and Microsoft 365. Its fusion and anomaly detection rules specifically reduce false positives by learning normal behavior patterns, making it the correct choice for this scenario.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Defender for Cloud
Why it's wrong here
Microsoft Defender for Cloud offers integrated security posture management and threat protection for Azure, hybrid, and multi-cloud environments. While it generates security alerts and recommendations for monitored resources, its core function is not to act as a centralized Security Information and Event Management (SIEM) system that ingests and correlates high volumes of disparate security logs from all enterprise sources into unified incidents. It lacks the broad data ingestion and advanced correlation capabilities required for a comprehensive SOC solution dealing with varied alert types.
- ✓
Microsoft Sentinel
Why this is correct
Microsoft Sentinel is a cloud-native Security Information and Event Management (SIEM) and Security Orchestration, Automation, and Response (SOAR) solution. It is specifically designed to ingest security data from virtually any source, including users, devices, applications, and infrastructure, across on-premises and multi-cloud environments. Sentinel leverages machine learning and AI to correlate high volumes of low-fidelity alerts into actionable incidents, significantly reducing noise and enabling efficient investigation and automated response within a unified platform.
- ✗
Microsoft Defender for Endpoint
Why it's wrong here
Microsoft Defender for Endpoint is an enterprise endpoint security platform that provides robust Endpoint Detection and Response (EDR) capabilities. Its primary function is to protect devices like workstations, servers, and mobile devices by detecting, investigating, and responding to advanced threats on those specific endpoints. While it generates critical security alerts from endpoint activity, it is not designed to ingest and correlate security events from diverse, non-endpoint sources such as network devices, cloud applications, or identity systems across an entire organization.
- ✗
Microsoft Defender for Cloud Apps
Why it's wrong here
Microsoft Defender for Cloud Apps functions as a Cloud Access Security Broker (CASB), providing comprehensive visibility, control, and protection for cloud applications. It helps discover shadow IT, protect sensitive data with data loss prevention (DLP), and defend against cyberthreats within sanctioned cloud apps. While it generates alerts related to cloud application usage and data, its scope is limited to cloud app security and it does not serve as a centralized platform for ingesting and correlating security alerts from all disparate security tools across an organization's entire IT landscape.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Microsoft 365
Microsoft 365 is a subscription-based cloud service from Microsoft that combines productivity tools like Office apps with security, device management, and online storage.
Key term
Security operations center
A Security Operations Center (SOC) is a centralized team and facility that monitors, detects, analyzes, and responds to cybersecurity incidents across an organization's IT environment 24/7.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.