SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
A company wants to deploy a single security operations portal that provides a unified view of alerts and incidents from Microsoft Defender for Endpoint, Microsoft Defender for Office 365, Microsoft Defender for Identity, and Microsoft Defender for Cloud Apps. Which Microsoft portal should the security team use?
⚠ Common exam trap
It's easy for candidates to confuse the Microsoft 365 Defender portal with the Azure Portal or the Microsoft 365 admin center, mistakenly thinking that security alerts are managed in the same place as Azure resources or tenant administration, when in fact the security portal is a dedicated, cross-workload console.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft 365 Defender portal
The Microsoft 365 Defender portal (https://security.microsoft.com) is the correct answer because it provides a unified security operations center (SOC) experience, aggregating alerts and incidents from Microsoft Defender for Endpoint, Defender for Office 365, Defender for Identity, and Defender for Cloud Apps. This portal enables security teams to triage, investigate, and respond to cross-domain threats in a single pane of glass, leveraging automated incident correlation and advanced hunting capabilities.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure Portal
Why it's wrong here
The Azure Portal is primarily a management console for Azure cloud resources, including virtual machines, storage accounts, and networking components. While it hosts services like Microsoft Defender for Cloud (formerly Azure Security Center) for cloud workload protection, it does not provide a consolidated, cross-product incident correlation view for the entire Microsoft 365 Defender suite, which spans endpoints, email, identity, and cloud applications. Its focus is on infrastructure and platform-as-a-service management.
- ✓
Microsoft 365 Defender portal
Why this is correct
This portal serves as the unified Extended Detection and Response (XDR) hub, consolidating security alerts, incidents, and advanced hunting capabilities across Microsoft Defender for Endpoint, Defender for Office 365, Defender for Identity, and Microsoft Defender for Cloud Apps. It provides security operations teams with a single-pane-of-glass view to investigate, analyze, and respond to threats across the entire digital estate, enabling comprehensive incident management and automated remediation.
- ✗
Microsoft 365 admin center
Why it's wrong here
This administrative portal is designed for managing the core aspects of a Microsoft 365 tenant, such as user accounts, groups, licenses, billing, domain settings, and service health. While it provides an overview of the tenant's operational status, it lacks the specialized tools, dashboards, and correlation engines required for active security incident detection, investigation, advanced hunting, or comprehensive threat response across diverse security products.
- ✗
Azure Active Directory admin center
Why it's wrong here
This portal is dedicated to managing identity and access within Azure Active Directory, encompassing user and group management, application registrations, conditional access policies, and identity protection features. While identity is a critical component of security, this portal's scope is limited to identity-centric configurations and reporting. It does not offer the broad, cross-domain incident correlation and unified security operations capabilities needed to manage threats across endpoints, email, and cloud applications.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Microsoft 365
Microsoft 365 is a subscription-based cloud service from Microsoft that combines productivity tools like Office apps with security, device management, and online storage.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.