SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
A company has multiple Azure virtual machines running various workloads. They want a central solution that continuously assesses their security posture, identifies vulnerabilities, and provides recommendations to harden the environment. Which Azure service should they use?
⚠ Common exam trap
Test-takers frequently confuse Microsoft Defender for Cloud (a posture management and workload protection platform) with Microsoft Sentinel (a SIEM/SOAR for threat detection), because both are security services under the 'Defender' umbrella, but Sentinel focuses on log-based threat hunting rather than continuous vulnerability assessment and hardening recommendations.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Defender for Cloud
Microsoft Defender for Cloud is the correct service because it provides continuous security posture assessment, vulnerability identification, and actionable hardening recommendations across Azure, on-premises, and multi-cloud environments. It integrates with Azure Policy and uses the Secure Score to quantify security posture, making it the central solution described in the scenario.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure Firewall
Why it's wrong here
Azure Firewall operates at the network layer, providing centralized, stateful firewall as a service for virtual networks and subscriptions. It enforces network access policies, filters traffic based on rules, and integrates with Microsoft Threat Intelligence for known malicious IP addresses and domains. However, its function is purely traffic filtering and protection, not continuous security posture assessment, vulnerability scanning of VMs, or generating security recommendations for workloads.
- ✓
Microsoft Defender for Cloud
Why this is correct
Microsoft Defender for Cloud is the correct solution as it offers comprehensive cloud security posture management (CSPM) and cloud workload protection (CWP) capabilities. It continuously assesses the security state of Azure Virtual Machines, identifying vulnerabilities, misconfigurations, and deviations from security best practices. It then provides actionable security recommendations, a secure score, and integrates with vulnerability assessment tools to enhance the overall security posture of the VMs and their running workloads.
- ✗
Azure DDoS Protection
Why it's wrong here
Azure DDoS Protection is designed exclusively to safeguard public IP addresses against distributed denial-of-service attacks, which aim to exhaust application resources or bandwidth. It provides always-on traffic monitoring and automatic mitigation of volumetric, protocol, and resource-layer attacks. While crucial for availability, this service focuses solely on preventing specific types of network attacks and offers no functionality for assessing the internal security posture, identifying software vulnerabilities, or providing security recommendations for virtual machines.
- ✗
Microsoft Sentinel
Why it's wrong here
Microsoft Sentinel functions as a cloud-native Security Information and Event Management (SIEM) and Security Orchestration, Automation, and Response (SOAR) solution. It ingests security data from various sources, including Azure VMs, to detect threats, investigate alerts, and automate responses to security incidents. While it can collect security logs from VMs, its primary purpose is threat detection and incident response, not continuous security posture assessment, vulnerability management, or providing proactive recommendations for improving the baseline security configuration of virtual machines.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Policy
A policy is a set of rules or guidelines that defines how an organization manages, secures, and operates its IT systems and services.
Key term
Azure Policy
Azure Policy is a service in Microsoft Azure that lets you create, assign, and manage rules to ensure your resources stay compliant with your company standards and service-level agreements.
About these practice questions
This SC-900 question is part of Courseiva's 1,250-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.