SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
An organization uses Microsoft 365 Defender. The security team receives an alert about a potential malware outbreak on multiple endpoints, and they need an integrated view that correlates signals from various Microsoft security solutions. Which Microsoft 365 Defender portal component provides this unified view?
⚠ Common exam trap
It's easy for candidates to confuse the Microsoft 365 Defender portal with Azure Sentinel, mistakenly thinking a SIEM is required for correlation, whereas the Microsoft 365 Defender portal already provides built-in, cross-product correlation without needing a separate SIEM tool.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft 365 Defender portal (security.microsoft.com)
The Microsoft 365 Defender portal (security.microsoft.com) is the correct answer because it provides a unified view of alerts and incidents across Microsoft 365 Defender components, including Microsoft Defender for Endpoint, Defender for Office 365, Defender for Identity, and Defender for Cloud Apps. This integrated correlation enables security teams to see the full scope of a potential malware outbreak across multiple endpoints by combining signals from these solutions into a single incident timeline.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Defender for Cloud
Why it's wrong here
Microsoft Defender for Cloud is primarily designed to provide Cloud Security Posture Management (CSPM) and Cloud Workload Protection (CWP) across multi-cloud and hybrid environments. It secures Azure, AWS, and GCP resources, including virtual machines, SQL databases, storage accounts, and containers. While it offers threat protection for these specific cloud assets, it does not natively unify or correlate threat signals from Microsoft 365 services like email (Defender for Office 365) or endpoints (Defender for Endpoint) into a single XDR incident view.
When this WOULD be correct
When the question asks for a centralized tool to assess and improve the security posture of Azure, on-premises, and other cloud resources, or to protect cloud workloads with integrated Microsoft Defender plans.
- ✓
Microsoft 365 Defender portal (security.microsoft.com)
Why this is correct
The Microsoft 365 Defender portal (security.microsoft.com) is the centralized management console for the Microsoft 365 Defender suite. It provides a unified XDR (eXtended Detection and Response) experience, correlating signals from Microsoft Defender for Endpoint, Defender for Office 365, Defender for Identity, and Microsoft Defender for Cloud Apps. This integration enables security teams to investigate and respond to sophisticated multi-stage attacks across endpoints, email, identities, and applications from a single pane of glass, streamlining incident management.
- ✗
Azure Sentinel
Why it's wrong here
Azure Sentinel is a cloud-native Security Information and Event Management (SIEM) and Security Orchestration, Automation, and Response (SOAR) solution. It is designed to collect security data from various sources across an organization's entire digital estate, including Microsoft 365 Defender components, other cloud providers, and on-premises systems. While Sentinel can ingest and analyze data from Microsoft 365 Defender, it acts as an aggregator and analytics platform rather than providing the native, integrated XDR experience and real-time incident correlation that the dedicated Microsoft 365 Defender portal offers for its own suite of products.
When this WOULD be correct
Azure Sentinel would be correct if the question asked for a cloud-native SIEM that ingests logs from multiple sources (including third-party) for advanced threat hunting, correlation, and automated response across hybrid environments.
- ✗
Microsoft Defender for Identity
Why it's wrong here
Microsoft Defender for Identity is a cloud-based security solution that leverages on-premises Active Directory signals to identify, detect, and investigate advanced threats, compromised identities, and malicious insider actions. It provides insights into user behavior analytics and detects suspicious activities like pass-the-hash or golden ticket attacks. However, Defender for Identity's scope is limited to identity-related threats and does not provide a unified console for correlating security incidents across endpoints, email, or cloud applications.
When this WOULD be correct
This option would be correct for a question asking: 'Which Microsoft solution provides identity threat detection and investigation capabilities for on-premises Active Directory environments?'
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SC-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Microsoft 365 Defender portal (security.microsoft.com)Correct answer▾
Why this is correct
The Microsoft 365 Defender portal (security.microsoft.com) is the centralized management console for the Microsoft 365 Defender suite. It provides a unified XDR (eXtended Detection and Response) experience, correlating signals from Microsoft Defender for Endpoint, Defender for Office 365, Defender for Identity, and Microsoft Defender for Cloud Apps. This integration enables security teams to investigate and respond to sophisticated multi-stage attacks across endpoints, email, identities, and applications from a single pane of glass, streamlining incident management.
✗Microsoft Defender for CloudWrong answer — click to see why▾
Why this is wrong here
Microsoft Defender for Cloud is a cloud security posture management (CSPM) and cloud workload protection platform (CWPP) for multicloud environments, not a unified portal for Microsoft 365 Defender's correlated signals across endpoints, email, and identity.
★ When this WOULD be the correct answer
When the question asks for a centralized tool to assess and improve the security posture of Azure, on-premises, and other cloud resources, or to protect cloud workloads with integrated Microsoft Defender plans.
Why candidates choose this
Candidates may confuse 'Defender for Cloud' with the Microsoft 365 Defender portal because both contain 'Defender' and relate to security, but they serve different scopes (cloud infrastructure vs. Microsoft 365 threat protection).
✗Azure SentinelWrong answer — click to see why▾
Why this is wrong here
Azure Sentinel is a cloud-native SIEM for security analytics and threat intelligence, not a unified portal for correlating signals from Microsoft 365 Defender solutions like Defender for Endpoint, Office 365, Identity, and Cloud Apps.
★ When this WOULD be the correct answer
Azure Sentinel would be correct if the question asked for a cloud-native SIEM that ingests logs from multiple sources (including third-party) for advanced threat hunting, correlation, and automated response across hybrid environments.
Why candidates choose this
Candidates may confuse Azure Sentinel's SIEM capabilities with the unified incident view in Microsoft 365 Defender, as both involve correlation of security alerts, but Sentinel is broader and not specific to Microsoft 365 Defender's integrated portal.
✗Microsoft Defender for IdentityWrong answer — click to see why▾
Why this is wrong here
Microsoft Defender for Identity focuses on detecting identity-based threats using on-premises Active Directory signals, not on providing a unified view of malware outbreaks across endpoints from multiple Microsoft security solutions.
★ When this WOULD be the correct answer
This option would be correct for a question asking: 'Which Microsoft solution provides identity threat detection and investigation capabilities for on-premises Active Directory environments?'
Why candidates choose this
Candidates may confuse Defender for Identity as part of the Microsoft 365 Defender suite and assume it contributes to the unified view, not realizing the portal itself is the integration point.
Analysis generated from the official SC-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Malware
Malware is any software intentionally designed to cause damage, disrupt operations, steal data, or gain unauthorized access to computer systems.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.