SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
A security operations team investigates a multi-stage attack that began with a phishing email, then moved to credential compromise, and finally to lateral movement on endpoints. They need a single pane of glass to view the entire attack story, including the initial email, the compromised user's sign-in activities, and processes on affected devices. Which Microsoft security solution provides this unified investigation experience?
⚠ Common exam trap
Test-takers frequently confuse Microsoft Sentinel (a SIEM) with Microsoft 365 Defender (an XDR), assuming that any cross-domain investigation requires a SIEM, when in fact Microsoft 365 Defender provides the native, pre-correlated attack story across email, identity, and endpoints without needing custom log ingestion.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft 365 Defender
Microsoft 365 Defender (now Microsoft Defender XDR) provides a unified investigation experience by correlating signals across email, identity, and endpoint domains into a single incident view. This allows the security team to see the full attack story—from the initial phishing email in Defender for Office 365, to the compromised user's sign-in activities via Defender for Identity, and the lateral movement processes on endpoints through Defender for Endpoint—all within one console.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Sentinel
Why it's wrong here
Microsoft Sentinel is a cloud-native Security Information and Event Management (SIEM) and Security Orchestration, Automation, and Response (SOAR) solution. It excels at ingesting security data from a vast array of sources, including Microsoft 365 services, other cloud providers, and on-premises systems, for centralized analysis and threat hunting. However, while Sentinel can be configured to correlate data, it does not offer the out-of-the-box, pre-built, and automated incident correlation across Microsoft 365 Defender components (Endpoint, Office 365, Identity, Cloud Apps) that Microsoft 365 Defender provides natively for multi-stage attack investigations.
When this WOULD be correct
A question that asks: 'Which Microsoft solution provides a cloud-native SIEM and SOAR platform for security analytics and threat intelligence across the enterprise?' In that context, Microsoft Sentinel would be the correct answer because it ingests data from various sources and enables custom detection and response.
- ✗
Microsoft Defender for Cloud
Why it's wrong here
Microsoft Defender for Cloud is primarily focused on cloud security posture management (CSPM) and cloud workload protection (CWP) across Azure, AWS, and GCP environments. While it provides robust threat protection for virtual machines, containers, databases, and other cloud resources, its scope does not natively extend to unifying threat intelligence from email systems (like Office 365) or on-premises identity infrastructure (like Active Directory). Therefore, it would not provide the comprehensive, cross-domain visibility needed to investigate a multi-stage attack spanning email, identity, and endpoints.
When this WOULD be correct
A question asking: 'Which Microsoft solution provides security posture management and threat protection for hybrid cloud workloads across Azure, AWS, and GCP?' would make Microsoft Defender for Cloud the correct answer.
- ✓
Microsoft 365 Defender
Why this is correct
Microsoft 365 Defender is the unified XDR (Extended Detection and Response) solution designed to protect an organization's entire digital estate across endpoints, email, identity, and cloud applications. It automatically correlates alerts and incidents from its constituent services (Defender for Endpoint, Office 365, Identity, and Cloud Apps) into a single, comprehensive incident view. This unified perspective is crucial for investigating multi-stage attacks, as it provides a holistic timeline and context across various attack vectors, enabling security operations teams to understand the full scope and impact of sophisticated threats.
- ✗
Microsoft Defender for Identity
Why it's wrong here
Microsoft Defender for Identity is a cloud-based security solution designed specifically to protect hybrid identity environments by monitoring Active Directory signals for advanced threats, compromised identities, and malicious insider actions. While critical for detecting identity-based attacks, it focuses exclusively on identity-related threats and does not provide visibility into other attack vectors such as email-borne threats (e.g., phishing) or endpoint compromises. Therefore, it lacks the broad, cross-domain context required to fully investigate and respond to a multi-stage attack that spans multiple security domains.
When this WOULD be correct
A question that asks: 'Which Microsoft solution provides advanced threat analytics and alerts for on-premises Active Directory attacks, such as pass-the-hash or golden ticket attacks?' would have Microsoft Defender for Identity as the correct answer.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SC-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Microsoft 365 DefenderCorrect answer▾
Why this is correct
Microsoft 365 Defender is the unified XDR (Extended Detection and Response) solution designed to protect an organization's entire digital estate across endpoints, email, identity, and cloud applications. It automatically correlates alerts and incidents from its constituent services (Defender for Endpoint, Office 365, Identity, and Cloud Apps) into a single, comprehensive incident view. This unified perspective is crucial for investigating multi-stage attacks, as it provides a holistic timeline and context across various attack vectors, enabling security operations teams to understand the full scope and impact of sophisticated threats.
✗Microsoft SentinelWrong answer — click to see why▾
Why this is wrong here
Microsoft Sentinel is a SIEM/SOAR solution that aggregates logs from multiple sources, but it does not natively provide a unified investigation experience across email, identity, and endpoints in a single attack story. The question specifically asks for a single pane of glass for the entire attack chain, which is a core capability of Microsoft 365 Defender.
★ When this WOULD be the correct answer
A question that asks: 'Which Microsoft solution provides a cloud-native SIEM and SOAR platform for security analytics and threat intelligence across the enterprise?' In that context, Microsoft Sentinel would be the correct answer because it ingests data from various sources and enables custom detection and response.
Why candidates choose this
Candidates may think Sentinel is the central security tool for all investigations because it can collect data from many sources, but they overlook that Microsoft 365 Defender offers a built-in, unified incident view specifically for the Microsoft 365 ecosystem.
✗Microsoft Defender for CloudWrong answer — click to see why▾
Why this is wrong here
Microsoft Defender for Cloud is a cloud security posture management (CSPM) and cloud workload protection platform (CWPP), not a unified investigation experience for multi-stage attacks spanning email, identity, and endpoints.
★ When this WOULD be the correct answer
A question asking: 'Which Microsoft solution provides security posture management and threat protection for hybrid cloud workloads across Azure, AWS, and GCP?' would make Microsoft Defender for Cloud the correct answer.
Why candidates choose this
Candidates may confuse 'Defender for Cloud' with the broader Microsoft 365 Defender suite, assuming it covers all security scenarios, or they may think it provides a unified investigation pane due to its name containing 'Defender'.
✗Microsoft Defender for IdentityWrong answer — click to see why▾
Why this is wrong here
Microsoft Defender for Identity focuses on detecting and investigating identity-based threats using on-premises Active Directory signals, but it does not provide a unified view across email, cloud app sign-ins, and endpoint processes as required by this multi-stage attack scenario.
★ When this WOULD be the correct answer
A question that asks: 'Which Microsoft solution provides advanced threat analytics and alerts for on-premises Active Directory attacks, such as pass-the-hash or golden ticket attacks?' would have Microsoft Defender for Identity as the correct answer.
Why candidates choose this
Candidates may associate Defender for Identity with identity compromise and lateral movement, but overlook that the question requires a single pane of glass covering email, sign-ins, and endpoints, which is the domain of Microsoft 365 Defender.
Analysis generated from the official SC-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Defender for Identity
Defender for Identity is a cloud-based security solution that detects, investigates, and responds to advanced identity threats targeting on-premises Active Directory and cloud identities.
Key term
Incident
An incident is a security event that violates an organization's policies or threatens its data, systems, or operations, requiring a structured response.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.