SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
An organization uses Microsoft Defender for Cloud to secure its Azure workloads. They want to receive recommendations for improving the security posture of their virtual machines. What should they enable?
⚠ Common exam trap
Candidates often confuse Azure Policy (which enforces rules) with CSPM (which assesses and recommends), or they think Microsoft Sentinel (a SIEM) is needed for security recommendations, when CSPM is the dedicated posture management service.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Defender for Cloud's Cloud Security Posture Management (CSPM)
Microsoft Defender for Cloud's Cloud Security Posture Management (CSPM) provides continuous assessment of Azure workloads, including virtual machines, against security baselines and best practices. It generates actionable recommendations to improve the security posture, such as applying missing system updates or enabling encryption. This is the correct feature for receiving VM-specific security recommendations.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Defender for Cloud Apps
Why it's wrong here
Microsoft Defender for Cloud Apps functions as a Cloud Access Security Broker (CASB), providing visibility, control, and protection for data across cloud applications, both sanctioned and unsanctioned. Its primary focus is on SaaS application security, including shadow IT discovery, information protection, and threat detection within cloud apps. It does not primarily provide security posture recommendations for underlying cloud infrastructure like virtual machines or network configurations.
- ✗
Microsoft Sentinel
Why it's wrong here
Microsoft Sentinel is a scalable, cloud-native Security Information and Event Management (SIEM) and Security Orchestration, Automation, and Response (SOAR) solution. It specializes in collecting security data from various sources, detecting threats using AI and machine learning, investigating alerts, and automating responses to incidents. While crucial for operational security, Sentinel's core function is not to proactively assess and provide recommendations for improving the security posture of cloud resources.
- ✓
Microsoft Defender for Cloud's Cloud Security Posture Management (CSPM)
Why this is correct
Microsoft Defender for Cloud's Cloud Security Posture Management (CSPM) continuously assesses cloud resources for misconfigurations and vulnerabilities across multi-cloud environments. It provides actionable security recommendations, prioritized by potential impact, to improve the organization's overall security posture. CSPM also includes compliance monitoring against regulatory standards and industry benchmarks, offering a unified view of security health.
- ✗
Azure Policy
Why it's wrong here
Azure Policy is a governance service that enables organizations to create, assign, and manage policies to enforce rules and effects over their Azure resources. It ensures compliance with corporate standards and service level agreements by preventing non-compliant resource creation or auditing existing resources. Unlike CSPM, Azure Policy primarily enforces predefined rules rather than dynamically generating security recommendations based on continuous threat intelligence and best practices.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Defender for Cloud
Microsoft Defender for Cloud is a cloud security posture management (CSPM) and cloud workload protection platform (CWPP) that provides unified security management and threat protection across hybrid and multi-cloud environments.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.