Match each Azure security service to its purpose.
Drag a concept onto its matching description — or click a concept then click the description.
Enforce organizational standards and assess compliance
Define repeatable Azure resources and policies
Unified security management and threat protection
Cloud-native SIEM and SOAR solution
Securely store and manage secrets and keys
Answer choices
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
Microsoft Defender for Cloud: A unified infrastructure security management system that strengthens security posture and provides advanced threat protection.
Common confusions involve mixing up the purposes of security management (Defender for Cloud), SIEM/SOAR (Sentinel), and secret management (Key Vault).
Answer analysis
For each option: why learners choose it and why it is or isn't the right answer here.
Microsoft Defender for Cloud: A unified infrastructure security management system that strengthens security posture and provides advanced threat protection.
Why this is correct
Microsoft Defender for Cloud serves as a comprehensive security solution that unifies security management across hybrid and multi-cloud environments. It continuously assesses the security posture of resources, providing actionable recommendations to strengthen defenses and improve compliance. Furthermore, it includes advanced threat protection capabilities to detect and respond to threats targeting cloud workloads, ensuring robust security.
Microsoft Defender for Cloud: A cloud-native SIEM and SOAR solution.
Why it's wrong here
This statement is incorrect because Microsoft Defender for Cloud's primary function is cloud security posture management (CSPM) and cloud workload protection (CWP), focusing on identifying vulnerabilities and providing threat protection for resources. It is not a Security Information and Event Management (SIEM) and Security Orchestration, Automation, and Response (SOAR) solution. A cloud-native SIEM and SOAR solution, designed for collecting security data, detecting threats, and automating responses, is actually Azure Sentinel.
Azure Sentinel: A scalable, cloud-native SIEM and SOAR solution.
Why this is correct
Azure Sentinel is accurately described as a scalable, cloud-native Security Information and Event Management (SIEM) and Security Orchestration, Automation, and Response (SOAR) solution. It provides centralized security event collection, intelligent threat detection using AI and machine learning, and automated incident response capabilities. This allows organizations to proactively identify, investigate, and mitigate threats across their entire digital estate.
Azure Sentinel: A tool for securely storing and managing secrets, keys, and certificates.
Why it's wrong here
This description is incorrect as Azure Sentinel is a SIEM and SOAR service, focused on security data collection, threat detection, and automated response across an organization's digital assets. It does not provide secure storage for cryptographic keys, secrets, or certificates. The service specifically designed for securely managing and storing such sensitive assets is Azure Key Vault, which serves a distinct purpose.
Azure Key Vault: A tool for securely storing and managing secrets, keys, and certificates.
Why this is correct
Azure Key Vault is correctly identified as a robust tool for securely storing and managing sensitive information such as cryptographic keys, secrets, and SSL/TLS certificates. It helps developers avoid hardcoding security information into applications by providing a centralized, highly secure repository. This service enhances data protection and compliance by controlling access to these critical assets through fine-grained permissions and audit trails.
Azure Key Vault: A unified infrastructure security management system that strengthens security posture.
Why it's wrong here
This statement is incorrect because Azure Key Vault's specific purpose is the secure management of cryptographic keys, secrets, and certificates, acting as a secure vault for sensitive credentials. It is not designed to be a unified infrastructure security management system that assesses security posture or provides broad threat protection across an environment. Those capabilities are the core functions of Microsoft Defender for Cloud, which offers a much wider scope of security management and threat detection.
Go deeper
Learn chapter
Core Security Concepts
Key term
Defender for Cloud
Microsoft Defender for Cloud is a cloud security posture management (CSPM) and cloud workload protection platform (CWPP) that provides unified security management and threat protection across hybrid and multi-cloud environments.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
This SC-900 question is part of Courseiva's 1,250-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.