SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
A security team uses Microsoft Defender XDR to respond to incidents. Which THREE components are part of Microsoft Defender XDR?
⚠ Common exam trap
A common mix-up: candidates confuse Microsoft Sentinel (a SIEM) as part of Defender XDR, when in fact Sentinel is a separate Azure service that can consume Defender XDR alerts but is not a component of the XDR platform itself.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Defender for Office 365
Microsoft Defender XDR is a unified extended detection and response platform that natively integrates signals from Microsoft Defender for Office 365 (email and collaboration protection), Microsoft Defender for Endpoint (endpoint detection and response), and Microsoft Defender for Identity (on-premises identity threat detection). These three components share telemetry and automate incident correlation across domains, which is the core purpose of Defender XDR.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Microsoft Defender for Office 365
Why this is correct
Microsoft Defender for Office 365 is a crucial component of Microsoft Defender XDR, specializing in protecting an organization's email, collaboration tools, and data within the Office 365 suite. It provides advanced protection against phishing, business email compromise (BEC), malware, and other sophisticated threats targeting email and cloud applications like SharePoint, OneDrive, and Teams. By integrating these signals, it enables a unified security response across the entire digital estate.
- ✓
Microsoft Defender for Endpoint
Why this is correct
Microsoft Defender for Endpoint is an essential part of the Microsoft Defender XDR suite, providing robust endpoint detection and response (EDR) capabilities across various devices. It safeguards workstations, servers, and mobile devices against advanced threats, offering vulnerability management, attack surface reduction, and automated investigation and remediation. Its integration within XDR allows for a correlated view of endpoint activities with other security domains, enhancing overall threat visibility and response.
- ✗
Microsoft Sentinel
Why it's wrong here
Microsoft Sentinel is a cloud-native Security Information and Event Management (SIEM) and Security Orchestration, Automation, and Response (SOAR) solution, distinct from the Microsoft Defender XDR suite. While it aggregates security data from various sources, including Defender XDR components, for broader log management, threat hunting, and compliance reporting, it does not provide the integrated, domain-specific detection and response capabilities that define XDR. Sentinel acts as an overarching security operations platform, whereas Defender XDR focuses on integrated, cross-domain protection and automated response.
- ✗
Microsoft Intune
Why it's wrong here
Microsoft Intune is a cloud-based service focused on unified endpoint management (UEM), specifically Mobile Device Management (MDM) and Mobile Application Management (MAM), and is not a core component of Microsoft Defender XDR. Its primary function is to manage and secure corporate and personal devices, enforce compliance policies, and deploy applications, rather than providing advanced threat detection and response capabilities. While Intune can integrate with Defender for Endpoint for device health and compliance, it operates as a management tool, separate from XDR's threat-centric security operations.
- ✓
Microsoft Defender for Identity
Why this is correct
Microsoft Defender for Identity is a critical component of Microsoft Defender XDR, dedicated to protecting hybrid identity environments, including on-premises Active Directory and Azure Active Directory. It identifies, detects, and investigates advanced threats, compromised identities, and malicious insider actions targeting user accounts and credentials. By monitoring user behavior and detecting suspicious activities like credential theft and lateral movement, it provides vital identity-based signals that are correlated within the XDR platform for comprehensive threat protection.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Anti-phishing policy
An anti-phishing policy is a set of rules and technical controls that organizations use to detect, block, and respond to email or message-based attacks that trick users into revealing sensitive information.
Key term
Defender for Endpoint
Microsoft Defender for Endpoint is a cloud-delivered enterprise security solution designed to protect devices from cyber threats using behavioral analysis, machine learning, and automated investigation.
About these practice questions
This SC-900 question is part of Courseiva's 1,250-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.