SC-900 Practice Question: Describe the concepts of security, compliance, and identity
Which Microsoft security solution provides centralized investigation and response across identities, endpoints, email, and cloud apps by correlating alerts from multiple sources?
⚠ Common exam trap
Candidates often confuse Microsoft Sentinel (a SIEM) with Microsoft Defender XDR (an XDR), but Sentinel ingests logs from multiple sources for broad visibility while XDR natively correlates alerts from Microsoft's own security products for automated response.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Defender XDR
Microsoft Defender XDR (Extended Detection and Response) is the correct answer because it is specifically designed to correlate alerts from identities, endpoints, email, and cloud apps into a single incident, providing centralized investigation and response. It uses the Microsoft 365 Defender portal to unify signals from Defender for Endpoint, Defender for Office 365, Defender for Identity, and Defender for Cloud Apps, enabling automated remediation across these domains.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Microsoft Defender XDR
Why this is correct
Microsoft Defender XDR is the correct solution because it provides extended detection and response capabilities across multiple security domains. It unifies protection, detection, and response by automatically correlating alerts from identities (Defender for Identity), endpoints (Defender for Endpoint), email and collaboration (Defender for Office 365), and cloud apps (Defender for Cloud Apps). This integrated approach enables security teams to conduct centralized investigations into complex, multi-stage attacks within a single portal, significantly improving incident response efficiency.
- ✗
Microsoft Purview
Why it's wrong here
Microsoft Purview is incorrect as its primary focus is on data governance, risk, and compliance, not security incident investigation or cross-domain threat correlation. It helps organizations understand, manage, and protect their sensitive data across hybrid and multi-cloud environments through capabilities like data loss prevention, information protection, and data lifecycle management. While crucial for data security, Purview does not provide the centralized security operations center (SOC) capabilities for active threat detection and response.
- ✗
Microsoft Sentinel
Why it's wrong here
Microsoft Sentinel is a cloud-native Security Information and Event Management (SIEM) and Security Orchestration, Automation, and Response (SOAR) solution, making it an incorrect choice for the specific context of *native* Microsoft XDR. While Sentinel can ingest security data from various sources, including Microsoft Defender products, and facilitate centralized analysis and threat hunting, it is a broader platform for log management and custom analytics. It does not inherently provide the integrated, cross-domain *correlation* of alerts from Microsoft's specific security products in the way Defender XDR does.
- ✗
Microsoft Intune
Why it's wrong here
Microsoft Intune is primarily a cloud-based endpoint management solution, making it an unsuitable answer for centralized security investigation and cross-domain threat correlation. Its core functions include mobile device management (MDM) and mobile application management (MAM), enabling organizations to manage and secure devices, configure policies, and deploy applications. Intune focuses on device health and compliance, not on detecting and responding to sophisticated security incidents that span identities, email, and cloud applications.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Extended Detection and Response
Extended Detection and Response (XDR) is a security approach that collects and analyzes data from multiple sources like endpoints, networks, servers, and email to detect and stop threats more effectively.
Key term
Defender for Office 365
Microsoft Defender for Office 365 is a cloud-based email security service that protects organizations against advanced threats like phishing, malware, and business email compromise by scanning emails, attachments, and links in real time.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.