SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
A company has deployed Microsoft Defender for Endpoint, Microsoft Defender for Office 365, Microsoft Defender for Identity, and Microsoft Defender for Cloud Apps. The security operations team wants a single, unified portal where they can view alerts from all these products, perform cross-domain investigations, and orchestrate automated response actions. Which Microsoft security solution should they use?
⚠ Common exam trap
Test-takers frequently confuse Microsoft Sentinel (a SIEM) with the unified Microsoft 365 Defender portal, not realizing that Sentinel is an aggregator for multiple data sources, while Microsoft 365 Defender is the native unified console for the Defender product family itself.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft 365 Defender
Microsoft 365 Defender is the correct answer because it is a unified pre- and post-breach enterprise defense suite that natively coordinates detection, prevention, investigation, and response across endpoints, identities, email, and cloud applications. It provides a single portal (security.microsoft.com) where alerts from Defender for Endpoint, Defender for Office 365, Defender for Identity, and Defender for Cloud Apps are correlated into incidents, enabling cross-domain investigation and automated response via playbooks and the Microsoft 365 Defender API.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Sentinel
Why it's wrong here
Microsoft Sentinel is a cloud-native SIEM and SOAR solution that can collect logs from various sources, but it is not the default unified portal for the four Defender products. The native unification comes from Microsoft 365 Defender.
When this WOULD be correct
Microsoft Sentinel would be correct if the question asked for a SIEM solution to aggregate security data from multiple sources (including non-Microsoft), perform advanced threat hunting with KQL, and orchestrate automated response across hybrid environments, rather than a unified portal for Microsoft Defender products.
- ✓
Microsoft 365 Defender
Why this is correct
Microsoft 365 Defender serves as the unified Extended Detection and Response (XDR) solution, integrating signals from Defender for Endpoint, Defender for Office 365, Defender for Identity, and Microsoft Defender for Cloud Apps. This comprehensive platform correlates alerts and incidents across these domains, enabling security operations teams to conduct cross-domain investigations and leverage automated response capabilities for a holistic security posture.
- ✗
Microsoft Defender for Cloud
Why it's wrong here
Microsoft Defender for Cloud offers comprehensive Cloud Security Posture Management (CSPM) and Cloud Workload Protection (CWP) across multi-cloud environments, including Azure, AWS, and GCP. Its primary focus is securing cloud infrastructure, services, and workloads, providing threat protection and compliance monitoring within the cloud context. It does not function as the central unified XDR portal that correlates incidents from all Microsoft 365 Defender components.
When this WOULD be correct
This option would be correct if the question asked for a solution to assess and improve the security posture of Azure, AWS, and GCP resources, or to protect cloud workloads with integrated vulnerability management and threat detection.
- ✗
Microsoft Defender for Endpoint
Why it's wrong here
Microsoft Defender for Endpoint is a dedicated enterprise endpoint security platform, providing robust capabilities such as Endpoint Detection and Response (EDR), next-generation antivirus, and vulnerability management for devices. While crucial for device protection, it is a foundational component that feeds into the broader Microsoft 365 Defender XDR solution, rather than being the overarching unified portal itself.
When this WOULD be correct
This option would be correct if the question asked: 'Which Microsoft security solution should be used to protect endpoints (devices) from advanced threats, including antivirus, endpoint detection and response (EDR), and automated investigation and remediation?'
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SC-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Microsoft 365 DefenderCorrect answer▾
Why this is correct
Microsoft 365 Defender serves as the unified Extended Detection and Response (XDR) solution, integrating signals from Defender for Endpoint, Defender for Office 365, Defender for Identity, and Microsoft Defender for Cloud Apps. This comprehensive platform correlates alerts and incidents across these domains, enabling security operations teams to conduct cross-domain investigations and leverage automated response capabilities for a holistic security posture.
✗Microsoft SentinelWrong answer — click to see why▾
Why this is wrong here
Microsoft Sentinel is a cloud-native SIEM/SOAR for ingesting logs from multiple sources, but it is not the unified portal for Microsoft 365 Defender products; the question specifies a single portal for alerts from Defender products, which is Microsoft 365 Defender.
★ When this WOULD be the correct answer
Microsoft Sentinel would be correct if the question asked for a SIEM solution to aggregate security data from multiple sources (including non-Microsoft), perform advanced threat hunting with KQL, and orchestrate automated response across hybrid environments, rather than a unified portal for Microsoft Defender products.
Why candidates choose this
Candidates may confuse Sentinel as the central portal because it can ingest alerts from Defender products and provide cross-domain investigation, but the question specifically asks for the unified portal for those Defender products, which is Microsoft 365 Defender.
✗Microsoft Defender for CloudWrong answer — click to see why▾
Why this is wrong here
Microsoft Defender for Cloud is a cloud security posture management (CSPM) and cloud workload protection platform (CWPP) for multicloud environments, not a unified portal for cross-domain investigation and automated response across Defender products.
★ When this WOULD be the correct answer
This option would be correct if the question asked for a solution to assess and improve the security posture of Azure, AWS, and GCP resources, or to protect cloud workloads with integrated vulnerability management and threat detection.
Why candidates choose this
Candidates may confuse 'Defender for Cloud' with a central security portal because its name suggests cloud-wide protection, and they may not distinguish between cloud workload protection and unified incident response across endpoints, identities, and apps.
✗Microsoft Defender for EndpointWrong answer — click to see why▾
Why this is wrong here
Microsoft Defender for Endpoint is a single-product security solution focused on endpoint protection, not a unified portal for cross-domain alerts from multiple Defender products. The question asks for a single portal integrating alerts from Defender for Endpoint, Office 365, Identity, and Cloud Apps, which is the role of Microsoft 365 Defender.
★ When this WOULD be the correct answer
This option would be correct if the question asked: 'Which Microsoft security solution should be used to protect endpoints (devices) from advanced threats, including antivirus, endpoint detection and response (EDR), and automated investigation and remediation?'
Why candidates choose this
Candidates may confuse Microsoft Defender for Endpoint with the broader Microsoft 365 Defender suite because the names are similar, or they may think the endpoint solution is the central console for all security alerts.
Analysis generated from the official SC-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Microsoft 365
Microsoft 365 is a subscription-based cloud service from Microsoft that combines productivity tools like Office apps with security, device management, and online storage.
Key term
Microsoft Defender
Microsoft Defender is a suite of security products that protects devices, data, and identities from cyber threats like malware, phishing, and unauthorized access.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.