SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
A security operations team uses Microsoft Defender for Cloud and has connected their AWS and GCP accounts. They want to continuously assess the security posture of AWS EC2 instances against the CIS AWS Foundations Benchmark and receive prioritized recommendations. Which feature of Defender for Cloud should they use?
⚠ Common exam trap
Watch out — candidates often confuse CSPM with workload protections (Option D) or Microsoft Defender for Servers (Option B), mistakenly thinking that threat detection or server-specific plans automatically include compliance assessment, when in fact CSPM is the dedicated feature for multi-cloud posture management and benchmark compliance.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Cloud Security Posture Management (CSPM)
Cloud Security Posture Management (CSPM) in Microsoft Defender for Cloud is specifically designed to continuously assess the security posture of multi-cloud resources (including AWS EC2 instances) against industry benchmarks like the CIS AWS Foundations Benchmark. CSPM provides a compliance dashboard, prioritized recommendations, and automated remediation guidance, directly addressing the team's need for ongoing assessment and prioritized recommendations.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Cloud Security Posture Management (CSPM)
Why this is correct
Cloud Security Posture Management (CSPM) is the core capability within Microsoft Defender for Cloud that continuously assesses cloud resources against security benchmarks and regulatory standards. It provides a secure score, identifies misconfigurations, and offers actionable recommendations to improve an organization's security posture across multi-cloud environments like Azure, AWS, and GCP. This proactive approach is essential for a security operations team focused on maintaining compliance and reducing attack surface.
- ✗
Microsoft Defender for Servers
Why it's wrong here
Microsoft Defender for Servers is a specific workload protection plan designed to provide advanced threat detection, vulnerability management, and just-in-time access for virtual machines and physical servers. While crucial for server security, its primary function is runtime protection and vulnerability assessment for individual server instances, not the overarching compliance benchmarking and secure score calculation for the entire cloud estate that CSPM offers.
- ✗
Security Alerts
Why it's wrong here
Security Alerts are notifications generated by Microsoft Defender for Cloud when a threat or suspicious activity is detected on a protected resource. These alerts are reactive, indicating a potential or active security incident that requires investigation and remediation. They are distinct from CSPM, which provides continuous, proactive assessment of configurations against security benchmarks to prevent misconfigurations and improve overall posture, rather than just reacting to threats.
- ✗
Workload protections
Why it's wrong here
Workload protections refer to the advanced threat detection and prevention capabilities tailored for specific resource types, such as Defender for Storage, Defender for Key Vault, or Defender for Containers. These features focus on securing specific services against runtime threats and vulnerabilities. While vital for comprehensive security, workload protections do not encompass the broader functionality of continuous posture assessment, compliance benchmarking, and secure score generation that CSPM provides across the entire cloud environment.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Security posture
An organization's overall cybersecurity strength, including policies, controls, and readiness to defend against and respond to threats.
Key term
Defender for Cloud
Microsoft Defender for Cloud is a cloud security posture management (CSPM) and cloud workload protection platform (CWPP) that provides unified security management and threat protection across hybrid and multi-cloud environments.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.