SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
A company has on-premises Active Directory. They want to detect advanced attacks like Pass-the-Hash, DCSync, and malicious Kerberos activity using behavioral analytics. Which Microsoft security solution should they deploy on their domain controllers?
⚠ Common exam trap
A common mix-up: candidates confuse Microsoft Defender for Identity with Microsoft Defender for Endpoint, assuming endpoint protection covers domain controllers, but MDI is specifically designed for Active Directory security and behavioral analytics against identity-based attacks.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Defender for Identity
Microsoft Defender for Identity (MDI) is the correct solution because it uses behavioral analytics and machine learning to detect advanced attacks specifically targeting on-premises Active Directory, such as Pass-the-Hash, DCSync, and malicious Kerberos activity. MDI monitors domain controller traffic, including Kerberos authentication and NTLM relay, to identify anomalous patterns indicative of these attacks.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Defender for Endpoint
Why it's wrong here
While Microsoft Defender for Endpoint provides robust Endpoint Detection and Response (EDR) capabilities for individual servers and workstations, detecting fileless malware, network exploits, and post-exploitation activities on the endpoint itself, it does not specialize in monitoring or analyzing Active Directory domain controller traffic or authentication protocols across the entire AD forest. Its primary focus is the security posture of the individual machine, not the collective identity threat landscape of the on-premises AD infrastructure.
- ✗
Microsoft Defender for Office 365
Why it's wrong here
Microsoft Defender for Office 365 is a cloud-native security solution specifically designed to protect an organization's email, documents, and collaboration tools (such as SharePoint Online, OneDrive for Business, and Microsoft Teams) from sophisticated phishing, malware, and business email compromise attacks. It operates exclusively within the Microsoft 365 cloud environment and lacks the visibility or capabilities to monitor or detect threats targeting an on-premises Active Directory infrastructure.
- ✓
Microsoft Defender for Identity
Why this is correct
Microsoft Defender for Identity (MDI) is purpose-built to detect advanced identity-based threats and anomalous activities specifically targeting on-premises Active Directory environments. It deploys sensors directly on domain controllers to monitor network traffic, authentication requests, and security logs, applying behavioral analytics and machine learning to identify suspicious user and entity behavior. This includes detecting reconnaissance, lateral movement, and credential theft techniques like Pass-the-Hash or Golden Ticket attacks, providing crucial insights into the AD attack kill chain.
- ✗
Microsoft Defender for Cloud Apps
Why it's wrong here
Microsoft Defender for Cloud Apps (formerly Microsoft Cloud App Security or MCAS) functions as a Cloud Access Security Broker (CASB), providing comprehensive visibility, control, and threat protection for cloud applications and services, both sanctioned and unsanctioned. Its primary role is to monitor user activity, enforce data loss prevention policies, and detect anomalous behavior within cloud app usage. Consequently, it is entirely irrelevant for detecting advanced attacks specifically targeting an on-premises Active Directory infrastructure.
Visual reference
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Microsoft Defender
Microsoft Defender is a suite of security products that protects devices, data, and identities from cyber threats like malware, phishing, and unauthorized access.
Key term
Authentication
Authentication is the process of verifying that someone or something is who or what it claims to be before granting access to a system or resource.
About these practice questions
This SC-900 question is part of Courseiva's 1,250-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.