Which Microsoft Security Solutions Detect Identity Threats?
Which TWO Microsoft security solutions can be used to detect and respond to identity-based threats? (Choose two.)
Quick Answer
The answer is Microsoft Defender for Identity and Microsoft Entra ID Protection. These two solutions work together to detect and respond to identity-based threats by analyzing different attack surfaces: Defender for Identity monitors on-premises Active Directory signals, network traffic, and behavioral patterns to catch advanced attacks like pass-the-hash or Kerberos golden ticket, while Entra ID Protection focuses on cloud-based identity risks such as anomalous sign-ins, leaked credentials, and risky user behaviors. On the SC-900 exam, this question tests your understanding of how Microsoft’s identity security portfolio divides responsibilities between on-premises and cloud environments—a common trap is confusing Defender for Cloud Apps or Azure AD with these two. Remember the memory tip: “Defender for Identity guards the castle (on-prem), Entra ID Protection patrols the cloud (Azure AD).”
⚠ Common exam trap
A common mix-up: candidates confuse Microsoft Defender for Cloud Apps (a CASB) with identity threat detection, but it is primarily for cloud app security, not on-premises identity attacks, while Microsoft Defender for Identity and Entra ID Protection are the two dedicated identity-focused solutions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Defender for Identity
Microsoft Defender for Identity (option C) is a cloud-based security solution that uses on-premises Active Directory signals to identify, detect, and investigate advanced threats, compromised identities, and malicious insider actions. It specifically focuses on identity-based attacks such as pass-the-hash, Kerberos golden ticket, and brute-force attempts by analyzing network traffic and behavior.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Defender for Cloud Apps
Why it's wrong here
Focuses on cloud app security.
- ✗
Microsoft Purview
Why it's wrong here
Focuses on data governance.
- ✓
Microsoft Defender for Identity
Why this is correct
Detects identity-based attacks.
- ✗
Microsoft Defender for Endpoint
Why it's wrong here
Focuses on endpoints, not identity.
- ✓
Microsoft Entra ID Protection
Why this is correct
Detects risky sign-ins and user risk.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Pass-the-hash
Pass-the-hash is a cyberattack where an attacker captures the hash of a user's password and uses it to authenticate to other systems without ever knowing the actual password.
About these practice questions
This SC-900 question is part of Courseiva's 1,250-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SC-900
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which TWO Microsoft security solutions can be used to detect and respond to threats across email, endpoints, and identities? (Choose two.)
easy- A.Microsoft Intune
- B.Microsoft Defender for Cloud Apps
- C.Microsoft Purview
- ✓ D.Microsoft Sentinel
- ✓ E.Microsoft Defender XDR
Why D: Microsoft Sentinel (option D) is correct because it is a cloud-native SIEM and SOAR platform that ingests logs from across the entire environment—including email, endpoints, and identity sources—to detect and respond to threats using analytics and automated playbooks. Microsoft Defender XDR (option E) is correct because it is a unified, pre- and post-breach detection and response solution that correlates signals across email (Exchange Online), endpoints (Microsoft Defender for Endpoint), and identities (Microsoft Defender for Identity).
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.