SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
Which THREE of the following are included in Microsoft Defender XDR (Extended Detection and Response)? (Choose three.)
⚠ Common exam trap
A common mix-up: candidates confuse Microsoft Defender for Cloud (a CSPM/CWPP tool) as part of Defender XDR, but it is not included; instead, the XDR suite focuses on endpoint, identity, email, and cloud app security, while Defender for Cloud remains a separate security management service.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Defender for Identity
Microsoft Defender XDR is the unified extended detection and response suite that bundles several Defender workloads under a single portal and correlation engine. Option A, Microsoft Defender for Identity, is correct because it is one of the core Defender XDR components, monitoring on-premises Active Directory signals (via sensors on domain controllers) for identity-based attacks. Option B, Microsoft Defender for Endpoint, is correct because it is the endpoint detection and response workload included in Defender XDR, providing device telemetry, threat detection, and automated investigation/response. Option D, Microsoft Defender for Office 365, is correct because it is the email and collaboration protection workload included in Defender XDR, covering Exchange Online, Teams, and SharePoint/OneDrive against phishing and malware. Option C, Microsoft Azure Information Protection, is not part of Defender XDR; it is a separate information-protection/classification service (now largely folded into Microsoft Purview Information Protection). Option E, Microsoft Defender for Cloud, is not part of Defender XDR; it is a cloud security posture management and workload protection (CSPM/CWPP) service that lives in the Azure portal and is distinct from the Defender XDR suite.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Microsoft Defender for Identity
Why this is correct
This solution provides comprehensive protection for hybrid identity environments by monitoring Active Directory and Microsoft Entra ID signals. It detects advanced threats, compromised identities, and malicious insider actions using behavioral analytics and machine learning. As a core component of Microsoft Defender XDR, it correlates identity-related incidents with signals from endpoints, email, and cloud apps to provide a unified view of an attack.
- ✓
Microsoft Defender for Endpoint
Why this is correct
This robust endpoint security platform offers advanced threat protection, post-breach detection, automated investigation, and response capabilities for devices. It utilizes Endpoint Detection and Response (EDR) technology, next-generation antivirus, and attack surface reduction to safeguard workstations, servers, and mobile devices. Integrated within Microsoft Defender XDR, it provides critical endpoint telemetry that enriches incident correlation and automated remediation across the entire security stack.
- ✗
Microsoft Azure Information Protection
Why it's wrong here
This is a distinct, standalone solution primarily focused on data classification, labeling, and protection, rather than being a core component of the Microsoft Defender XDR suite. It enables organizations to discover, classify, and protect sensitive information throughout its lifecycle, employing encryption and access controls. While it plays a crucial role in data loss prevention and compliance, its function is separate from the unified threat detection and response capabilities offered by the Defender XDR components.
- ✓
Microsoft Defender for Office 365
Why this is correct
This specialized security service safeguards an organization's email, documents, and collaboration tools within Microsoft 365 against sophisticated threats. It provides advanced protection against phishing, malware, business email compromise, and zero-day attacks through features like Safe Attachments and Safe Links. As an integral part of Microsoft Defender XDR, it contributes vital email and collaboration threat intelligence, enabling coordinated investigation and automated response across the entire digital estate.
- ✗
Microsoft Defender for Cloud
Why it's wrong here
This comprehensive solution is designed to strengthen the security posture of cloud workloads across Azure, AWS, and Google Cloud Platform, and provide advanced threat protection. It functions as a Cloud Security Posture Management (CSPM) and Cloud Workload Protection Platform (CWPP), offering security recommendations and vulnerability assessments. While it integrates with other Microsoft security services, it is not considered one of the core, unified components of the Microsoft Defender XDR suite, which specifically focuses on identity, endpoint, email, and cloud app security.
Go deeper
Related to this question
Learn chapter
Hybrid Identity with Entra Connect
Key term
SSE
SSE (Security Service Edge) is a cloud-centric security framework that converges web, cloud, and network security into a single edge service.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
One of 1,279 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.