SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
A company has enabled Microsoft Defender for Cloud. They want to assess their Azure resources for compliance with security benchmarks like CIS and Azure Security Benchmark, and view a secure score. Which feature of Defender for Cloud provides this capability?
⚠ Common exam trap
Many exam-takers confuse workload protection plans (like Defender for Servers) with posture management features, assuming any 'Defender' plan includes compliance assessment, whereas CSPM is the dedicated feature for benchmarks and secure score.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Cloud Security Posture Management (CSPM)
Cloud Security Posture Management (CSPM) is the Defender for Cloud feature specifically designed to assess Azure resources against industry security benchmarks such as CIS and the Azure Security Benchmark. It continuously evaluates your environment, provides a secure score based on compliance findings, and offers actionable recommendations to improve your security posture. This directly matches the scenario's requirement for benchmark compliance assessment and secure score visibility.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Cloud Security Posture Management (CSPM)
Why this is correct
Cloud Security Posture Management (CSPM) is the foundational capability within Microsoft Defender for Cloud that provides continuous, real-time assessment of an organization's security posture across its cloud environments. It automatically identifies misconfigurations, vulnerabilities, and compliance deviations against industry benchmarks like CIS and regulatory standards. CSPM generates a secure score, offering actionable recommendations to improve security and maintain compliance, making it the direct answer for assessing posture.
- ✗
Microsoft Defender for Servers
Why it's wrong here
Microsoft Defender for Servers is a specific plan within Defender for Cloud designed to provide advanced threat protection capabilities for Windows and Linux servers, whether they are in Azure, on-premises, or in other clouds. While crucial for workload security, its primary function is to detect and respond to threats targeting server operating systems and applications, not to provide the overarching cloud security posture assessment, secure score, or compliance management across the entire cloud environment.
- ✗
Microsoft Defender for App Service
Why it's wrong here
Microsoft Defender for App Service is a dedicated Defender for Cloud plan that provides advanced, intelligent threat protection specifically tailored for Azure App Service environments. It monitors for suspicious activities targeting web applications, APIs, and functions hosted on App Service, such as unusual file uploads, remote code execution attempts, or data exfiltration. However, it does not offer the comprehensive security posture assessment, secure score calculation, or compliance benchmarking that spans across all cloud resources.
- ✗
Just-in-time (JIT) VM access
Why it's wrong here
Just-in-time (JIT) VM access is a security feature within Microsoft Defender for Cloud that significantly reduces the attack surface of virtual machines by locking down inbound network access. It allows temporary, controlled access to specific ports only when explicitly requested and approved, rather than leaving them permanently open. While a critical security control for VMs, JIT VM access is a preventative measure for network access and does not provide continuous security posture assessment, secure score calculations, or compliance reporting for the overall cloud environment.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Microsoft Defender
Microsoft Defender is a suite of security products that protects devices, data, and identities from cyber threats like malware, phishing, and unauthorized access.
Key term
General Data Protection Regulation
A European Union law that gives individuals control over their personal data and sets strict rules for how organizations collect, store, and process that data.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.