SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
An organization wants to detect and respond to threats across their cloud infrastructure, including Azure, AWS, and GCP. Which Microsoft security solution should they centralize their security monitoring in?
⚠ Common exam trap
Watch out — candidates often confuse Microsoft Defender for Cloud (a CSPM/CWPP tool) with a SIEM, but Defender for Cloud does not provide the centralized log ingestion, correlation, and incident response across multiple cloud providers that Sentinel offers.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Sentinel
Microsoft Sentinel is the correct choice because it is a cloud-native Security Information and Event Management (SIEM) and Security Orchestration Automated Response (SOAR) solution designed to ingest logs and alerts from multiple cloud providers, including Azure, AWS, and GCP, via native connectors and industry-standard protocols like Syslog and CEF. It centralizes threat detection and response across heterogeneous cloud environments, whereas the other options focus on specific security domains or single-cloud protection.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Purview
Why it's wrong here
Microsoft Purview is a unified data governance solution focused on data discovery, classification, lineage, and compliance management across an organization's data estate. While it helps protect sensitive data by enforcing policies and managing data lifecycle, its primary function is not real-time threat detection, incident response, or security information and event management (SIEM) across diverse security logs, making it unsuitable for broad threat detection and response.
- ✓
Microsoft Sentinel
Why this is correct
Microsoft Sentinel is a cloud-native Security Information and Event Management (SIEM) and Security Orchestration, Automation, and Response (SOAR) solution. It ingests security data from virtually any source, including users, devices, applications, and infrastructure, across multi-cloud and on-premises environments. Sentinel then uses AI and machine learning to detect advanced threats, investigate incidents, and automate responses, providing comprehensive threat detection and response capabilities.
- ✗
Microsoft Defender for Cloud
Why it's wrong here
Microsoft Defender for Cloud provides Cloud Security Posture Management (CSPM) and Cloud Workload Protection (CWPP) across Azure, hybrid, and multi-cloud environments. It focuses on strengthening the security posture of cloud resources, identifying vulnerabilities, and protecting specific workloads like VMs, containers, and databases. While it detects threats within its defined scope of cloud infrastructure and workloads, it is not a comprehensive SIEM solution designed for aggregating and analyzing security events from an entire organization's diverse IT landscape for overarching threat detection and response.
- ✗
Microsoft Defender for Cloud Apps
Why it's wrong here
Microsoft Defender for Cloud Apps functions as a Cloud Access Security Broker (CASB) that extends visibility, control, and protection to cloud applications. Its core capabilities include discovering shadow IT, protecting sensitive information within cloud apps, and detecting anomalous behavior or threats related to SaaS application usage. While it provides threat protection specifically for cloud applications, it is not a broad SIEM or XDR solution for detecting and responding to threats across an organization's entire infrastructure, endpoints, and identity systems.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
SIEM
SIEM (Security Information and Event Management) is a system that collects and analyzes log data from across an IT environment to detect and respond to security threats in real time.
Key term
Event
An event is any identifiable occurrence or action in a computer system, network, or application that can be logged, monitored, or analyzed for security or operational purposes.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.