SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
A security operations center (SOC) team needs to collect security logs from Azure services, on-premises servers, and third-party firewalls. They want a cloud-native solution that provides advanced threat detection through analytics, machine learning, and the ability to hunt for threats across all data sources. Which Microsoft solution should they deploy?
⚠ Common exam trap
Many exam-takers confuse Microsoft Defender for Cloud (a CSPM/CWPP tool) with Microsoft Sentinel (a cloud-native SIEM), as both appear in the Azure portal and deal with security logs, but only Sentinel provides centralized log ingestion, analytics, and threat hunting across heterogeneous sources.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Sentinel
Microsoft Sentinel is the correct choice because it is a cloud-native SIEM (Security Information and Event Management) solution that ingests logs from Azure services, on-premises servers, and third-party firewalls. It provides advanced threat detection via built-in analytics, machine learning models, and a powerful query language (Kusto Query Language) for threat hunting across all data sources.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Defender for Cloud
Why it's wrong here
Microsoft Defender for Cloud offers Cloud Security Posture Management (CSPM) and Cloud Workload Protection (CWP) across multi-cloud and hybrid environments. It helps organizations strengthen the security posture of their cloud resources and protects workloads running on Azure, AWS, and GCP by providing recommendations and threat detection. While it collects security data relevant to cloud resource health and threats, it is not a comprehensive SIEM solution for aggregating and analyzing security logs from all on-premises systems, network devices, or diverse third-party applications.
When this WOULD be correct
This option would be correct if the question asked for a solution to assess and improve the security posture of Azure resources, detect misconfigurations, and protect cloud workloads with integrated Microsoft Defender plans, without requiring SIEM capabilities for log collection from on-premises and third-party sources.
- ✗
Microsoft 365 Defender
Why it's wrong here
Microsoft 365 Defender is an Extended Detection and Response (XDR) suite that unifies protection across endpoints, identities, email, and cloud apps within the Microsoft 365 ecosystem. It correlates alerts and signals from its integrated components (e.g., Defender for Endpoint, Defender for Office 365) to provide a holistic view of attacks targeting Microsoft 365 resources. However, it is not a general-purpose SIEM for ingesting and analyzing security logs from non-Microsoft 365 sources, on-premises infrastructure, or other cloud providers.
When this WOULD be correct
A question asking for a unified security solution to protect an organization's Microsoft 365 suite—including email, Teams, SharePoint, and endpoints—against advanced attacks, with automated investigation and response across these workloads, would make Microsoft 365 Defender the correct answer.
- ✓
Microsoft Sentinel
Why this is correct
Microsoft Sentinel is the correct choice because it is a cloud-native Security Information and Event Management (SIEM) and Security Orchestration, Automation, and Response (SOAR) solution. It is specifically designed to collect security data from virtually any source, including Azure services, other cloud providers, on-premises infrastructure, and third-party security solutions. Its powerful analytics, machine learning, and threat intelligence capabilities enable SOC teams to detect, investigate, and respond to threats across their entire enterprise environment effectively.
- ✗
Microsoft Defender for Identity
Why it's wrong here
Microsoft Defender for Identity (MDI) is an identity-centric security solution focused on protecting hybrid identity environments. It monitors signals from on-premises Active Directory domain controllers and other identity sources to detect advanced threats like pass-the-hash, Golden Ticket attacks, and other identity-based compromises. While critical for identity protection, MDI is not a SIEM; it does not aggregate security logs from diverse sources such as firewalls, operating systems, or cloud applications beyond its specific identity scope.
When this WOULD be correct
A question asking for a solution to detect and investigate identity threats in an on-premises Active Directory environment, such as compromised credentials or lateral movement, would make Microsoft Defender for Identity the correct answer.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SC-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Microsoft SentinelCorrect answer▾
Why this is correct
Microsoft Sentinel is the correct choice because it is a cloud-native Security Information and Event Management (SIEM) and Security Orchestration, Automation, and Response (SOAR) solution. It is specifically designed to collect security data from virtually any source, including Azure services, other cloud providers, on-premises infrastructure, and third-party security solutions. Its powerful analytics, machine learning, and threat intelligence capabilities enable SOC teams to detect, investigate, and respond to threats across their entire enterprise environment effectively.
✗Microsoft Defender for CloudWrong answer — click to see why▾
Why this is wrong here
Microsoft Defender for Cloud is a cloud security posture management (CSPM) and cloud workload protection platform (CWPP) that focuses on securing Azure, hybrid, and multi-cloud environments, but it does not provide the advanced threat hunting, analytics, and machine learning capabilities across diverse log sources (on-premises, third-party) that Microsoft Sentinel offers as a SIEM/SOAR solution.
★ When this WOULD be the correct answer
This option would be correct if the question asked for a solution to assess and improve the security posture of Azure resources, detect misconfigurations, and protect cloud workloads with integrated Microsoft Defender plans, without requiring SIEM capabilities for log collection from on-premises and third-party sources.
Why candidates choose this
Candidates may confuse Defender for Cloud's threat detection and security alerts with a full SIEM solution, or they may think its integration with Azure services covers all log collection needs, overlooking the requirement for a cloud-native SIEM like Sentinel.
✗Microsoft 365 DefenderWrong answer — click to see why▾
Why this is wrong here
Microsoft 365 Defender is designed to protect Microsoft 365 environments (email, endpoints, identities) and does not natively ingest logs from third-party firewalls or on-premises servers outside the Microsoft ecosystem, nor does it provide the centralized SIEM/SOAR capabilities required for multi-source log collection and advanced threat hunting.
★ When this WOULD be the correct answer
A question asking for a unified security solution to protect an organization's Microsoft 365 suite—including email, Teams, SharePoint, and endpoints—against advanced attacks, with automated investigation and response across these workloads, would make Microsoft 365 Defender the correct answer.
Why candidates choose this
Candidates may confuse Microsoft 365 Defender's advanced threat detection and automation with a SIEM solution, or assume it can aggregate logs from any source because it integrates with Microsoft Defender for Cloud and other Microsoft security products.
✗Microsoft Defender for IdentityWrong answer — click to see why▾
Why this is wrong here
Microsoft Defender for Identity focuses on protecting on-premises Active Directory identities and detecting identity-based attacks, not on collecting and analyzing security logs from diverse sources like Azure services, on-premises servers, and third-party firewalls with advanced threat hunting.
★ When this WOULD be the correct answer
A question asking for a solution to detect and investigate identity threats in an on-premises Active Directory environment, such as compromised credentials or lateral movement, would make Microsoft Defender for Identity the correct answer.
Why candidates choose this
Candidates may confuse Defender for Identity with a broader security analytics tool because its name includes 'Defender' and 'Identity,' leading them to think it covers all security log collection and threat detection.
Analysis generated from the official SC-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Threat
A threat is any potential danger that could harm a computer system, network, or data, whether from a malicious hacker, a natural disaster, or an accidental mistake.
Key term
Security operations center
A Security Operations Center (SOC) is a centralized team and facility that monitors, detects, analyzes, and responds to cybersecurity incidents across an organization's IT environment 24/7.
About these practice questions
This SC-900 question is part of Courseiva's 1,250-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.