SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
A security team needs to continuously assess the security posture of Azure resources, including virtual machines, storage accounts, and SQL databases. They also want to identify vulnerabilities in both Windows and Linux servers running in Azure and on-premises, and receive prioritized recommendations for remediation. Which Microsoft security solution should they use?
⚠ Common exam trap
It's easy for candidates to confuse Microsoft Defender for Cloud (a CSPM and workload protection solution) with Microsoft Defender for Endpoint (an EDR solution), but the question's focus on assessing security posture of Azure resources and hybrid servers points specifically to Defender for Cloud's CSPM capabilities.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Defender for Cloud
Microsoft Defender for Cloud is the correct solution because it provides continuous assessment of Azure resources (VMs, storage accounts, SQL databases) and hybrid workloads, including vulnerability scanning for Windows and Linux servers both in Azure and on-premises. It delivers prioritized remediation recommendations based on the secure score and integrated vulnerability assessment tools like Qualys or Microsoft Defender Vulnerability Management.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Microsoft Defender for Cloud
Why this is correct
Microsoft Defender for Cloud is the correct choice because it provides comprehensive Cloud Security Posture Management (CSPM) and Cloud Workload Protection Platform (CWPP) capabilities. It continuously assesses the security posture of Azure, on-premises, and multi-cloud environments by identifying misconfigurations, vulnerabilities, and compliance deviations. This service offers actionable security recommendations and a secure score to proactively enhance an organization's overall security.
- ✗
Microsoft Defender for Endpoint
Why it's wrong here
Microsoft Defender for Endpoint is a unified endpoint security platform designed to protect workstations, servers, and mobile devices from advanced threats. It provides capabilities like Endpoint Detection and Response (EDR), next-generation antivirus, and threat and vulnerability management specifically for endpoints. This solution focuses on device-level protection and threat hunting, rather than assessing the security posture or configurations of cloud infrastructure services like Azure storage accounts or virtual networks.
When this WOULD be correct
A question asking for a solution to protect endpoints (Windows/Linux servers, workstations) from advanced threats, with capabilities for antivirus, EDR, and vulnerability management on those devices, would make Defender for Endpoint the correct answer.
- ✗
Microsoft Sentinel
Why it's wrong here
Microsoft Sentinel is a Security Information and Event Management (SIEM) and Security Orchestration, Automation, and Response (SOAR) solution. Its primary function is to collect security data from various sources, detect active threats using analytics and machine learning, and automate responses to security incidents. While crucial for threat detection and incident management, Sentinel does not proactively scan for vulnerabilities or assess the security configuration of cloud resources.
When this WOULD be correct
A question asking for a cloud-native SIEM that ingests security data from multiple sources (e.g., Azure, on-premises, other clouds) to detect, investigate, and respond to threats, and that provides advanced analytics and automation for incident response.
- ✗
Microsoft Purview
Why it's wrong here
Microsoft Purview is a suite of data governance, risk, and compliance solutions. It helps organizations understand, classify, and protect sensitive data across their digital estate, enabling data loss prevention (DLP) and managing insider risks. Purview's focus is on data lifecycle management and regulatory compliance for data itself, not on the continuous security assessment of underlying infrastructure components or cloud service configurations.
When this WOULD be correct
A question asks: 'Which Microsoft solution should an organization use to classify sensitive data across Azure, on-premises, and multi-cloud environments, and enforce data protection policies?'
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SC-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Microsoft Defender for CloudCorrect answer▾
Why this is correct
Microsoft Defender for Cloud is the correct choice because it provides comprehensive Cloud Security Posture Management (CSPM) and Cloud Workload Protection Platform (CWPP) capabilities. It continuously assesses the security posture of Azure, on-premises, and multi-cloud environments by identifying misconfigurations, vulnerabilities, and compliance deviations. This service offers actionable security recommendations and a secure score to proactively enhance an organization's overall security.
✗Microsoft Defender for EndpointWrong answer — click to see why▾
Why this is wrong here
Microsoft Defender for Endpoint focuses on endpoint detection and response (EDR) for devices, not on assessing the security posture of Azure resources like VMs, storage accounts, and SQL databases, nor does it provide prioritized remediation recommendations for cloud infrastructure.
★ When this WOULD be the correct answer
A question asking for a solution to protect endpoints (Windows/Linux servers, workstations) from advanced threats, with capabilities for antivirus, EDR, and vulnerability management on those devices, would make Defender for Endpoint the correct answer.
Why candidates choose this
Candidates may confuse Defender for Endpoint's vulnerability management features for servers with the broader cloud security posture management (CSPM) capabilities of Defender for Cloud, especially since both can assess server vulnerabilities.
✗Microsoft SentinelWrong answer — click to see why▾
Why this is wrong here
Microsoft Sentinel is a SIEM/SOAR solution for threat detection and response across the enterprise, not a tool for continuously assessing security posture and identifying vulnerabilities in Azure resources and servers.
★ When this WOULD be the correct answer
A question asking for a cloud-native SIEM that ingests security data from multiple sources (e.g., Azure, on-premises, other clouds) to detect, investigate, and respond to threats, and that provides advanced analytics and automation for incident response.
Why candidates choose this
Candidates may confuse Sentinel's security monitoring capabilities with the posture assessment and vulnerability management features of Defender for Cloud, especially since both involve security analysis.
✗Microsoft PurviewWrong answer — click to see why▾
Why this is wrong here
Microsoft Purview focuses on data governance, classification, and compliance (e.g., data loss prevention, information protection), not on assessing security posture or identifying vulnerabilities in Azure resources and servers.
★ When this WOULD be the correct answer
A question asks: 'Which Microsoft solution should an organization use to classify sensitive data across Azure, on-premises, and multi-cloud environments, and enforce data protection policies?'
Why candidates choose this
Candidates may confuse Purview's data security capabilities (like data classification and labeling) with general security posture assessment, or they might think 'Purview' covers all security due to its broad name.
Analysis generated from the official SC-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Security posture
An organization's overall cybersecurity strength, including policies, controls, and readiness to defend against and respond to threats.
Key term
Microsoft Defender
Microsoft Defender is a suite of security products that protects devices, data, and identities from cyber threats like malware, phishing, and unauthorized access.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.