Multicloud Security Posture Management with Microsoft Defender for Cloud
A company runs workloads in Microsoft Azure and in Google Cloud Platform (GCP). The security team needs a single dashboard to view the security posture of both cloud environments, get recommendations for misconfigurations based on best practices, and track compliance with industry standards such as ISO 27001 and PCI DSS. Which Microsoft security solution should they use?
Quick Answer
The answer is Microsoft Defender for Cloud. This is the correct choice because it delivers unified multicloud security posture management, enabling a single dashboard to assess and improve security across Azure and Google Cloud Platform (GCP) environments. It continuously evaluates workloads against best-practice frameworks like the Microsoft cloud security benchmark, surfaces actionable recommendations for misconfigurations, and tracks compliance with standards such as ISO 27001 and PCI DSS through dedicated regulatory compliance dashboards. On the SC-900 exam, this scenario tests your understanding of how Defender for Cloud extends beyond Azure to provide cross-cloud visibility, a concept often confused with Azure Policy (which is Azure-only) or Microsoft Sentinel (which focuses on threat detection, not posture). A common trap is assuming a third-party tool is needed for GCP, but Defender for Cloud natively supports multicloud environments. Memory tip: think “Defender for Cloud = one pane of glass for posture, compliance, and recommendations across clouds.”
⚠ Common exam trap
Many candidates confuse Microsoft Sentinel (a SIEM for threat detection) with Defender for Cloud (a CSPM for posture management), because both appear under the 'Microsoft security solutions' umbrella and both can ingest data from multiple clouds, but Sentinel is not designed for compliance tracking or misconfiguration recommendations.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Defender for Cloud
Microsoft Defender for Cloud is the correct solution because it provides a unified dashboard for assessing and improving the security posture of multicloud environments, including Azure and GCP. It offers continuous assessment against best practices (e.g., the Microsoft cloud security benchmark), generates actionable recommendations for misconfigurations, and tracks compliance with industry standards like ISO 27001 and PCI DSS through built-in regulatory compliance dashboards.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Microsoft Defender for Cloud
Why this is correct
Defender for Cloud provides multicloud security posture management, including recommendations and compliance dashboards across Azure, AWS, and GCP.
- ✗
Microsoft Sentinel
Why it's wrong here
Sentinel is a cloud-native SIEM/SOAR for threat detection and response, not a tool for assessing security posture and providing recommendations on misconfigurations.
When this WOULD be correct
A company needs to collect and analyze security logs from multiple clouds, detect threats, and orchestrate automated responses to incidents. They require a centralized SIEM for real-time monitoring and investigation across Azure and GCP.
- ✗
Microsoft Defender for Cloud Apps
Why it's wrong here
Defender for Cloud Apps is a Cloud Access Security Broker (CASB) that focuses on visibility and control over cloud applications, not on infrastructure posture.
- ✗
Microsoft Defender for Endpoint
Why it's wrong here
Defender for Endpoint is an enterprise endpoint security platform for managing and protecting devices, not for multicloud infrastructure posture assessment.
When this WOULD be correct
A company needs a unified endpoint security solution to protect devices (Windows, macOS, Linux) from threats, with capabilities like antivirus, attack surface reduction, and endpoint detection and response (EDR), but does not require multi-cloud posture management.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SC-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Microsoft Defender for CloudCorrect answer▾
Why this is correct
Defender for Cloud provides multicloud security posture management, including recommendations and compliance dashboards across Azure, AWS, and GCP.
✗Microsoft SentinelWrong answer — click to see why▾
Why this is wrong here
Microsoft Sentinel is a SIEM/SOAR solution for security analytics and threat detection, not a dashboard for multi-cloud security posture management, misconfiguration recommendations, or compliance tracking against standards like ISO 27001 and PCI DSS.
★ When this WOULD be the correct answer
A company needs to collect and analyze security logs from multiple clouds, detect threats, and orchestrate automated responses to incidents. They require a centralized SIEM for real-time monitoring and investigation across Azure and GCP.
Why candidates choose this
Candidates may confuse Sentinel's log aggregation and threat detection capabilities with the posture management and compliance features of Defender for Cloud, assuming a SIEM can also provide compliance dashboards and recommendations.
✗Microsoft Defender for EndpointWrong answer — click to see why▾
Why this is wrong here
Microsoft Defender for Endpoint focuses on endpoint protection (antivirus, EDR) for devices, not on multi-cloud security posture management, compliance tracking, or misconfiguration recommendations across Azure and GCP.
★ When this WOULD be the correct answer
A company needs a unified endpoint security solution to protect devices (Windows, macOS, Linux) from threats, with capabilities like antivirus, attack surface reduction, and endpoint detection and response (EDR), but does not require multi-cloud posture management.
Why candidates choose this
Candidates may confuse 'Defender' branding, assuming all Defender products provide similar cloud security capabilities, or they may think endpoint security includes cloud workload protection.
Analysis generated from the official SC-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Payment Card Industry Data Security Standards
A set of security rules that any company that handles credit card payments must follow to protect cardholder data from theft and fraud.
Key term
Microsoft Defender
Microsoft Defender is a suite of security products that protects devices, data, and identities from cyber threats like malware, phishing, and unauthorized access.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SC-900
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company uses a hybrid environment with Azure virtual machines (IaaS) and on-premises Windows servers. The security team needs a single solution that continuously assesses the security posture of these workloads, provides a regulatory compliance dashboard with actionable recommendations, and enables threat detection. Which Microsoft security solution should they use?
medium- A.Microsoft Defender for Cloud Apps
- B.Microsoft Defender for Endpoint
- ✓ C.Microsoft Defender for Cloud
- D.Microsoft Sentinel
Why C: Microsoft Defender for Cloud is the correct answer because it provides a unified security management platform that continuously assesses the security posture of both Azure VMs (IaaS) and on-premises Windows servers via Azure Arc. It offers a regulatory compliance dashboard with actionable recommendations based on built-in standards like CIS, NIST, and Azure Security Benchmark, and integrates with Microsoft Defender for Cloud's workload protection plans to enable threat detection for these hybrid workloads.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.