SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
An organization uses Microsoft Defender for Endpoint (MDE). The security team wants to identify devices that have not received a security update in the last 30 days. Which report should they use?
⚠ Common exam trap
Many exam-takers confuse the Vulnerability management dashboard (which shows vulnerabilities) with a report that tracks update installation recency, but the dashboard does not provide a simple list of devices by last update date.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Device health report
The Device health report in Microsoft Defender for Endpoint provides a list of devices and their last security update status, including the date of the last update. This report directly answers the requirement to identify devices that have not received a security update in the last 30 days by showing the 'Last update' column and allowing filtering by update age.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Threat analytics report
Why it's wrong here
The Threat analytics report in Microsoft Defender for Endpoint offers expert-level analysis of active threats, including their impact, prevalence, and recommended mitigations. It focuses on emerging threats, attack techniques, and adversary campaigns, providing actionable intelligence to help security teams understand and respond to specific threats. However, it does not provide a direct report or dashboard view of individual device patch status or missing security updates.
- ✓
Device health report
Why this is correct
The Device health report within Microsoft Defender for Endpoint provides a comprehensive overview of the security posture and operational status of managed devices. This report specifically includes critical information such as the status of security updates, antivirus protection, firewall configuration, and sensor health. Organizations can leverage this report to quickly identify devices that are missing essential security updates, thereby addressing potential vulnerabilities and ensuring compliance.
- ✗
Vulnerability management dashboard
Why it's wrong here
The Vulnerability management dashboard, part of Microsoft Defender Vulnerability Management, provides a prioritized view of software vulnerabilities and misconfigurations across an organization's endpoints. While missing security updates often lead to identified vulnerabilities, this dashboard focuses on the *impact* and *risk* of those vulnerabilities, rather than a straightforward list or report of devices simply missing updates. It requires deeper analysis to correlate specific vulnerabilities back to individual patch statuses.
- ✗
Microsoft Secure Score report
Why it's wrong here
The Microsoft Secure Score report provides a quantitative measure of an organization's overall security posture across various Microsoft services, including Defender for Endpoint. It offers recommendations to improve security, contributing to a higher score, but it is an aggregate metric. This report does not provide granular, device-specific details about missing security updates for individual endpoints; instead, it reflects a high-level organizational security hygiene.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Security update
A security update is a software patch released to fix a vulnerability that could be exploited by attackers to compromise a system.
Key term
Microsoft Defender
Microsoft Defender is a suite of security products that protects devices, data, and identities from cyber threats like malware, phishing, and unauthorized access.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.