SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
A security team needs to collect and analyze security logs from a hybrid environment consisting of on-premises Windows servers, Azure virtual machines, and AWS workloads. They want to correlate events, detect anomalous behavior, and create custom security alerts with automated response playbooks. Which Microsoft security solution should they use?
⚠ Common exam trap
A common mix-up: candidates confuse Microsoft Defender for Cloud (a CSPM/CWPP tool) with a full SIEM solution, but Defender for Cloud lacks the log correlation, custom alert creation, and SOAR playbook capabilities that are exclusive to Microsoft Sentinel.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Sentinel
Microsoft Sentinel is the correct solution because it is a cloud-native SIEM (Security Information and Event Management) and SOAR (Security Orchestration, Automation, and Response) solution designed to ingest logs from hybrid and multi-cloud environments, including on-premises Windows servers, Azure VMs, and AWS workloads. It provides advanced correlation of events across these sources, built-in anomaly detection using machine learning, and the ability to create custom security alerts and automated response playbooks via Azure Logic Apps. This directly matches the requirement for collecting, analyzing, correlating, detecting anomalies, and automating responses.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Defender for Cloud
Why it's wrong here
Microsoft Defender for Cloud primarily functions as a Cloud Security Posture Management (CSPM) and Cloud Workload Protection Platform (CWPP). While it provides security recommendations, vulnerability assessments, and threat protection for Azure, AWS, and GCP resources, it is not designed as a centralized Security Information and Event Management (SIEM) solution. It lacks the comprehensive log ingestion capabilities from diverse on-premises and multi-cloud sources, advanced correlation rules, and Security Orchestration, Automation, and Response (SOAR) playbooks required for enterprise-wide security operations.
- ✓
Microsoft Sentinel
Why this is correct
Microsoft Sentinel is a cloud-native Security Information and Event Management (SIEM) and Security Orchestration, Automation, and Response (SOAR) solution. It excels at collecting security data from virtually any source, including Azure services, on-premises infrastructure, other cloud providers (AWS, GCP), and third-party applications. Sentinel leverages AI and machine learning for intelligent threat detection, provides advanced analytics for correlating events, and enables automated responses through integrated SOAR playbooks, making it ideal for comprehensive security log analysis and incident management.
- ✗
Microsoft Defender for Office 365
Why it's wrong here
Microsoft Defender for Office 365 is a specialized security solution focused on protecting an organization's email and collaboration services, such as Exchange Online, SharePoint Online, OneDrive for Business, and Microsoft Teams. Its primary function is to safeguard against sophisticated threats like phishing, business email compromise, and malware. It does not provide the broad log ingestion, correlation, or SOAR capabilities necessary for an enterprise-wide Security Information and Event Management (SIEM) platform that analyzes logs from diverse infrastructure and applications.
- ✗
Microsoft Defender for Identity
Why it's wrong here
Microsoft Defender for Identity is an identity-based security solution designed to detect advanced threats, compromised identities, and malicious insider actions targeting on-premises Active Directory environments. It monitors user behavior and detects suspicious activities like pass-the-hash, golden ticket attacks, and reconnaissance. While crucial for identity protection, it is not a comprehensive Security Information and Event Management (SIEM) platform capable of aggregating logs from diverse cloud providers, on-premises systems, or offering Security Orchestration, Automation, and Response (SOAR) functionalities.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Event
An event is any identifiable occurrence or action in a computer system, network, or application that can be logged, monitored, or analyzed for security or operational purposes.
Key term
Microsoft Sentinel
Microsoft Sentinel is a cloud-native security information and event management (SIEM) and security orchestration automation and response (SOAR) service that helps organizations detect, investigate, and respond to cyber threats across their entire digital estate.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.