SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
Which TWO are capabilities of Microsoft Intune? (Choose two.)
⚠ Common exam trap
Watch out — candidates often confuse Intune's capabilities with those of other Microsoft security solutions, such as associating Identity Protection (Entra ID) or DLP (Purview) with Intune, because all are part of the Microsoft security ecosystem but serve distinct functions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Mobile application management (MAM)
Microsoft Intune is a cloud-based endpoint management solution that provides both Mobile Device Management (MDM) and Mobile Application Management (MAM). MDM allows administrators to enroll, configure, and secure devices (e.g., enforce PIN policies, wipe lost devices), while MAM enables management of applications and their data on both enrolled and unenrolled devices (e.g., restrict copy/paste between managed apps). These are the two core capabilities of Intune.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Mobile application management (MAM)
Why this is correct
Intune's Mobile Application Management (MAM) capabilities allow organizations to manage and protect corporate data within applications, even on personal devices (BYOD) not enrolled in MDM. This includes enforcing policies like requiring a PIN for app access, preventing copy/paste of corporate data to personal apps, and encrypting data at rest within the app container. MAM ensures data security and compliance without requiring full device control.
- ✗
Identity protection
Why it's wrong here
Identity Protection is a feature of Microsoft Entra ID (formerly Azure Active Directory) that detects, investigates, and remediates identity-based risks. It uses machine learning to identify suspicious activities like impossible travel, leaked credentials, or anomalous sign-ins, then enforces policies such as multi-factor authentication or password resets. While Intune integrates with Entra ID for user authentication, Intune itself does not provide the core identity protection risk detection and remediation services.
- ✗
Security posture management
Why it's wrong here
Security posture management, specifically Cloud Security Posture Management (CSPM), is a primary capability of Microsoft Defender for Cloud. It continuously assesses the security configuration of cloud resources across Azure, AWS, and GCP, identifies misconfigurations, and provides recommendations to improve the overall security posture. While Intune contributes to endpoint security, it does not offer the broad cloud infrastructure security posture assessment and remediation provided by Defender for Cloud.
- ✗
Data loss prevention
Why it's wrong here
Data Loss Prevention (DLP) is a core service within Microsoft Purview that identifies, monitors, and automatically protects sensitive information across various locations like Microsoft 365 services, endpoints, and on-premises repositories. DLP policies prevent accidental or intentional sharing of sensitive data outside organizational boundaries. While Intune can help enforce endpoint compliance, it does not provide the comprehensive content inspection and policy-based data protection that is the hallmark of Microsoft Purview DLP.
- ✓
Mobile device management (MDM)
Why this is correct
Intune's Mobile Device Management (MDM) capabilities enable organizations to enroll, configure, and manage the entire lifecycle of corporate-owned and personal mobile devices, as well as desktops. This includes deploying security policies, configuring Wi-Fi and VPN profiles, managing app deployments, and enforcing compliance settings like OS version and encryption. MDM provides full device control, ensuring devices meet organizational security standards before accessing corporate resources.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Intune
Microsoft Intune is a cloud-based service that helps organizations manage their users' devices and applications, ensuring security and compliance without needing to own or control the physical hardware.
Key term
Mobile device management
Mobile device management (MDM) is a security solution that allows IT administrators to enroll, configure, monitor, and enforce policies on smartphones, tablets, and other mobile devices used in an organization.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.