SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
A security team wants to monitor and proactively defend against cyber threats across their entire infrastructure, including Azure virtual machines, on-premises servers, and AWS workloads. They need a unified solution that provides endpoint detection and response (EDR), vulnerability management, and threat hunting capabilities. Which Microsoft security solution should they use?
⚠ Common exam trap
It's easy for candidates to confuse Microsoft Defender for Cloud (a CSPM/CWPP) with Microsoft Defender for Endpoint (an EDR), mistakenly thinking that Defender for Cloud alone provides endpoint-level detection and response, when in fact it relies on Defender for Endpoint for those capabilities.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Defender for Endpoint
Microsoft Defender for Endpoint (B) is the correct answer because it provides unified endpoint detection and response (EDR), vulnerability management, and threat hunting across heterogeneous environments, including Azure VMs, on-premises servers, and AWS workloads. It extends beyond Windows to support Linux and macOS endpoints, and can be onboarded via Microsoft Defender for Cloud for multi-cloud visibility, making it the single solution that meets all the stated requirements.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Defender for Cloud
Why it's wrong here
Microsoft Defender for Cloud primarily functions as a Cloud Security Posture Management (CSPM) and Cloud Workload Protection Platform (CWPP) solution. It provides visibility into security posture, identifies misconfigurations, and offers protection for cloud and hybrid workloads. While it integrates with endpoint security solutions, it does not natively provide the granular Endpoint Detection and Response (EDR) capabilities required for proactive threat defense directly on servers and VMs.
- ✓
Microsoft Defender for Endpoint
Why this is correct
Microsoft Defender for Endpoint is specifically designed to provide comprehensive Endpoint Detection and Response (EDR), next-generation protection, automated investigation and remediation, and vulnerability management across endpoints. It offers advanced capabilities like threat hunting, attack surface reduction, and deep visibility into endpoint activities. This makes it the ideal solution for monitoring and proactively defending against advanced threats on servers, workstations, and cloud virtual machines.
- ✗
Microsoft Sentinel
Why it's wrong here
Microsoft Sentinel is a cloud-native Security Information and Event Management (SIEM) and Security Orchestration, Automation, and Response (SOAR) solution. Its primary role is to collect security data from various sources, correlate events, detect threats using analytics and machine learning, and automate responses. However, Sentinel itself does not provide direct endpoint protection or EDR capabilities; it relies on other security tools, such as Defender for Endpoint, to feed it endpoint-specific security data.
- ✗
Microsoft Defender for Cloud Apps
Why it's wrong here
Microsoft Defender for Cloud Apps operates as a Cloud Access Security Broker (CASB) that provides visibility, control, and protection for cloud applications and data. It helps discover shadow IT, enforce data loss prevention (DLP) policies, and protect sensitive information within cloud services. Its focus is on cloud application security and governance, not on providing endpoint-level threat detection and response for servers or virtual machines.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Microsoft Defender for Endpoint
Microsoft Defender for Endpoint is a cloud-delivered enterprise-grade security platform that protects devices, servers, and networks from advanced cyber threats by combining antivirus, endpoint detection and response, and automated investigation and remediation.
Key term
Defender for Cloud
Microsoft Defender for Cloud is a cloud security posture management (CSPM) and cloud workload protection platform (CWPP) that provides unified security management and threat protection across hybrid and multi-cloud environments.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.