SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
A security operations team needs a solution that can detect and stop ransomware attacks on Windows servers and desktops in real time. They also want the ability to automatically isolate affected devices and, if necessary, roll back files modified by ransomware using a built-in recovery feature. Which Microsoft security solution provides these capabilities?
⚠ Common exam trap
Many candidates confuse Microsoft Defender for Cloud (a cloud workload protection tool) with Microsoft Defender for Endpoint (an endpoint detection and response tool), failing to recognize that only MDE provides the specific combination of real-time endpoint protection, automated device isolation, and built-in file rollback for Windows servers and desktops.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Defender for Endpoint
Microsoft Defender for Endpoint (MDE) provides real-time detection and automated response to ransomware attacks on Windows servers and desktops. Its built-in attack surface reduction rules, endpoint detection and response (EDR), and automated investigation and remediation capabilities allow automatic device isolation. Additionally, MDE includes a file recovery feature that leverages Volume Shadow Copy to roll back files modified by ransomware, meeting all stated requirements.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Defender for Office 365
Why it's wrong here
Microsoft Defender for Office 365 is designed to protect an organization's email, Microsoft Teams, SharePoint Online, and OneDrive for Business from advanced threats like phishing, business email compromise, and malware. It employs safe attachments, safe links, and anti-phishing policies to safeguard collaboration tools. However, it does not provide endpoint detection and response (EDR) capabilities such as device isolation or file rollback, which are critical for managing threats directly on workstations or servers.
- ✓
Microsoft Defender for Endpoint
Why this is correct
Microsoft Defender for Endpoint is a comprehensive endpoint detection and response (EDR) solution that provides advanced threat protection, post-breach detection, automated investigation, and response capabilities for devices. It continuously monitors endpoint behavior, identifies malicious activities, and offers powerful remediation actions such as isolating compromised devices from the network and rolling back malicious file changes. These features are essential for containing and recovering from sophisticated endpoint attacks like ransomware.
- ✗
Microsoft Defender for Cloud Apps
Why it's wrong here
Microsoft Defender for Cloud Apps functions as a Cloud Access Security Broker (CASB), extending visibility and control over cloud applications and services. It helps discover shadow IT, enforce data loss prevention (DLP) policies, and monitor user activity across sanctioned and unsanctioned cloud apps. While crucial for cloud security, its primary focus is on securing data and access within cloud applications, not on providing direct endpoint device protection or ransomware recovery capabilities for individual workstations.
- ✗
Microsoft Defender for Cloud
Why it's wrong here
Microsoft Defender for Cloud offers comprehensive cloud security posture management (CSPM) and cloud workload protection (CWP) across multicloud environments, including Azure, AWS, and GCP. It identifies security misconfigurations, provides recommendations to strengthen security posture, and protects various cloud workloads like VMs, containers, and databases. Although it can monitor some endpoint agents within cloud VMs, it does not provide the specific device isolation or file rollback capabilities on user endpoints implied by the question.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Attack surface reduction
Attack surface reduction is a set of security practices that minimizes the number of ways an attacker can access or exploit a system by removing unnecessary features, locking down configurations, and controlling software behavior.
Key term
Recovery
Recovery is the process of restoring systems, data, and operations after a security incident, failure, or disaster to return to normal functioning.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.