SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
A security operations team uses Microsoft 365 Defender and wants to detect, investigate, and automatically respond to advanced identity-based attacks targeting on-premises Active Directory, such as Pass-the-Hash (PtH) and Golden Ticket attacks. They also need to integrate these alerts into Microsoft Sentinel for central incident management. Which Microsoft security solution provides these capabilities?
⚠ Common exam trap
Candidates often confuse Microsoft Defender for Identity with Microsoft Defender for Cloud Apps, assuming both handle identity threats, but only MDI specifically targets on-premises Active Directory attacks like PtH and Golden Ticket.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Defender for Identity
Microsoft Defender for Identity (MDI) is the correct answer because it is specifically designed to detect, investigate, and automatically respond to advanced identity-based attacks targeting on-premises Active Directory, including Pass-the-Hash (PtH) and Golden Ticket attacks. It uses behavioral analytics and machine learning to identify suspicious activities such as anomalous Kerberos ticket requests and NTLM authentication anomalies. MDI also natively integrates with Microsoft Sentinel, allowing alerts to be ingested for central incident management.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Microsoft Defender for Identity
Why this is correct
Microsoft Defender for Identity is purpose-built to safeguard on-premises Active Directory environments from sophisticated identity-based attacks. It leverages behavioral analytics to detect suspicious activities like Pass-the-Hash, Golden Ticket attacks, and lateral movement attempts across the network. By monitoring domain controllers and AD FS servers, it provides crucial insights into compromised identities and facilitates automated investigation and response within the Microsoft 365 Defender portal.
- ✗
Microsoft Defender for Cloud Apps
Why it's wrong here
Microsoft Defender for Cloud Apps functions as a comprehensive Cloud Access Security Broker (CASB), extending visibility and control over an organization's cloud application usage. It discovers shadow IT, enforces data loss prevention (DLP) policies, and detects anomalous user behavior across sanctioned and unsanctioned cloud services like SaaS and PaaS. Its focus is on cloud application security and compliance, distinct from protecting an on-premises Active Directory domain.
When this WOULD be correct
A question asking which Microsoft solution detects and controls risky user behavior in cloud apps, such as anomalous sign-ins or data exfiltration from SaaS applications, and integrates with Microsoft Sentinel for incident management.
- ✗
Microsoft Defender for Endpoint
Why it's wrong here
Microsoft Defender for Endpoint delivers robust endpoint detection and response (EDR) capabilities, focusing on securing devices such as workstations, servers, and mobile devices. It protects against malware, exploits, and fileless attacks by monitoring endpoint behavior, identifying vulnerabilities, and providing automated remediation actions. While essential for device security, its primary scope is not the specialized protection of on-premises Active Directory infrastructure from identity-specific threats.
- ✗
Microsoft Defender for Office 365
Why it's wrong here
Microsoft Defender for Office 365 provides advanced protection against threats targeting email and collaboration tools within the Microsoft 365 ecosystem. It safeguards against sophisticated phishing campaigns, malware, and spam across Exchange Online, SharePoint Online, OneDrive for Business, and Microsoft Teams. Features like Safe Attachments and Safe Links analyze content in real-time to prevent users from accessing malicious files or URLs, specifically addressing communication and content security.
When this WOULD be correct
A question asks: 'A company wants to protect against advanced phishing attacks targeting executives via email, and automatically remediate malicious messages. Which Microsoft security solution should they use?'
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SC-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Microsoft Defender for IdentityCorrect answer▾
Why this is correct
Microsoft Defender for Identity is purpose-built to safeguard on-premises Active Directory environments from sophisticated identity-based attacks. It leverages behavioral analytics to detect suspicious activities like Pass-the-Hash, Golden Ticket attacks, and lateral movement attempts across the network. By monitoring domain controllers and AD FS servers, it provides crucial insights into compromised identities and facilitates automated investigation and response within the Microsoft 365 Defender portal.
✗Microsoft Defender for Cloud AppsWrong answer — click to see why▾
Why this is wrong here
Microsoft Defender for Cloud Apps focuses on cloud application security, not on-premises Active Directory attacks like Pass-the-Hash or Golden Ticket. It does not provide native detection for these identity-based attacks targeting on-prem AD.
★ When this WOULD be the correct answer
A question asking which Microsoft solution detects and controls risky user behavior in cloud apps, such as anomalous sign-ins or data exfiltration from SaaS applications, and integrates with Microsoft Sentinel for incident management.
Why candidates choose this
Candidates may confuse Defender for Cloud Apps with identity protection because it handles user behavior and app usage, but it lacks the on-prem AD attack detection required here.
✗Microsoft Defender for Office 365Wrong answer — click to see why▾
Why this is wrong here
Microsoft Defender for Office 365 focuses on email and collaboration threats (phishing, malware in attachments/links), not on-premises Active Directory attacks like Pass-the-Hash or Golden Ticket. It does not provide identity-based attack detection for AD or integrate with Microsoft Sentinel for those alerts.
★ When this WOULD be the correct answer
A question asks: 'A company wants to protect against advanced phishing attacks targeting executives via email, and automatically remediate malicious messages. Which Microsoft security solution should they use?'
Why candidates choose this
Candidates may confuse the 'Defender' branding and assume all Defender products cover similar threats, or they might think Office 365 includes identity protection because it integrates with Azure AD.
Analysis generated from the official SC-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Microsoft Defender
Microsoft Defender is a suite of security products that protects devices, data, and identities from cyber threats like malware, phishing, and unauthorized access.
Key term
Kerberos
Kerberos is a network authentication protocol that uses tickets and symmetric-key cryptography to verify the identity of users and services in a secure, non-repudiable way.
About these practice questions
This SC-900 question is part of Courseiva's 1,250-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.