SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
A company has deployed Microsoft 365 Defender to unify threat detection and response. Which two components are included within the Microsoft 365 Defender integrated solution? (Select all that apply.)
⚠ Common exam trap
Many candidates confuse Microsoft Defender for Cloud (a cloud security solution) with Microsoft Defender for Cloud Apps (a CASB component of Microsoft 365 Defender), leading them to incorrectly select Defender for Cloud as part of the integrated solution.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Defender for Endpoint
Microsoft 365 Defender is an integrated threat protection suite that unifies detection and response across an organization's Microsoft 365 environment. It includes Microsoft Defender for Endpoint, which provides endpoint detection and response (EDR) capabilities for devices, and Microsoft Defender for Office 365, which protects against email, phishing, and collaboration threats. These two components work together within the Microsoft 365 Defender portal to correlate alerts and automate response across endpoints and Office 365 workloads.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Microsoft Defender for Endpoint
Why this is correct
Microsoft Defender for Endpoint is a foundational component of Microsoft 365 Defender, providing robust endpoint detection and response (EDR) capabilities across various operating systems. It offers next-generation protection, automated investigation and remediation, and vulnerability management, integrating its rich telemetry directly into the unified M365 Defender portal. This integration enables comprehensive visibility and coordinated threat response across devices, ensuring endpoints are protected from sophisticated attacks.
- ✗
Microsoft Defender for Cloud
Why it's wrong here
Microsoft Defender for Cloud is a comprehensive cloud security posture management (CSPM) and cloud workload protection (CWP) solution, primarily focused on securing Azure, multi-cloud (AWS, GCP), and hybrid environments. It provides security recommendations, threat protection for servers, containers, databases, and other cloud resources, and regulatory compliance. Although it shares the "Defender" branding, its scope is distinct from Microsoft 365 Defender, which focuses on end-user identities, endpoints, email, and cloud applications.
When this WOULD be correct
In a question asking 'Which Microsoft security solution provides cloud workload protection for Azure, on-premises, and multi-cloud environments?', Microsoft Defender for Cloud would be the correct answer.
- ✓
Microsoft Defender for Office 365
Why this is correct
Microsoft Defender for Office 365 is an integral service within the Microsoft 365 Defender suite, specifically designed to safeguard email, collaboration tools, and files from advanced threats. It provides robust protection against phishing, business email compromise (BEC), malware, and zero-day attacks through features like Safe Attachments and Safe Links across Exchange Online, SharePoint Online, OneDrive for Business, and Microsoft Teams. Its telemetry and alerts are seamlessly integrated, contributing to a holistic view of an organization's threat landscape.
- ✗
Microsoft Sentinel
Why it's wrong here
Microsoft Sentinel is a cloud-native Security Information and Event Management (SIEM) and Security Orchestration, Automation, and Response (SOAR) solution, designed for enterprise-wide security operations. While it can ingest security data from Microsoft 365 Defender and many other sources across an entire digital estate, it operates as a distinct, overarching security platform, not as a direct component or module within the Microsoft 365 Defender suite. Its purpose is broader, focusing on comprehensive log aggregation, threat hunting, and automated response across diverse environments.
When this WOULD be correct
Microsoft Sentinel would be the correct answer in a question asking: 'Which Microsoft security solution provides SIEM and SOAR capabilities across the enterprise, including integration with Microsoft 365 Defender?' or 'Which Azure-native service ingests security data from multiple sources for advanced threat detection and response?'
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SC-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Microsoft Defender for EndpointCorrect answer▾
Why this is correct
Microsoft Defender for Endpoint is a foundational component of Microsoft 365 Defender, providing robust endpoint detection and response (EDR) capabilities across various operating systems. It offers next-generation protection, automated investigation and remediation, and vulnerability management, integrating its rich telemetry directly into the unified M365 Defender portal. This integration enables comprehensive visibility and coordinated threat response across devices, ensuring endpoints are protected from sophisticated attacks.
✗Microsoft Defender for CloudWrong answer — click to see why▾
Why this is wrong here
Microsoft Defender for Cloud is a cloud security posture management (CSPM) and cloud workload protection platform (CWPP) tool, not a component of the Microsoft 365 Defender integrated solution, which focuses on endpoint, email, and identity threats.
★ When this WOULD be the correct answer
In a question asking 'Which Microsoft security solution provides cloud workload protection for Azure, on-premises, and multi-cloud environments?', Microsoft Defender for Cloud would be the correct answer.
Why candidates choose this
Candidates may confuse Microsoft Defender for Cloud with Microsoft 365 Defender due to the similar naming and the fact that both are part of Microsoft's security portfolio, leading them to assume it is included in the integrated solution.
✗Microsoft SentinelWrong answer — click to see why▾
Why this is wrong here
Microsoft Sentinel is a cloud-native SIEM and SOAR solution, not a component of Microsoft 365 Defender. The question asks for components within the integrated Microsoft 365 Defender solution, which includes Defender for Endpoint, Office 365, Identity, and Cloud Apps, but not Sentinel.
★ When this WOULD be the correct answer
Microsoft Sentinel would be the correct answer in a question asking: 'Which Microsoft security solution provides SIEM and SOAR capabilities across the enterprise, including integration with Microsoft 365 Defender?' or 'Which Azure-native service ingests security data from multiple sources for advanced threat detection and response?'
Why candidates choose this
Candidates may confuse Microsoft Sentinel as part of Microsoft 365 Defender because both are Microsoft security solutions that integrate threat detection and response, and Sentinel can ingest data from Microsoft 365 Defender, leading to the misconception that it is a component.
Analysis generated from the official SC-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Microsoft Entra ID
Key term
Endpoint detection and response
Endpoint detection and response (EDR) is a cybersecurity solution that continuously monitors endpoint devices for suspicious activity and automatically responds to threats to stop attacks in real time.
Key term
Organization
An Organization is a top-level container in Google Cloud that represents your company or entities and serves as the root node for all your cloud resources, policies, and access control.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.