SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
Which TWO capabilities are provided by Microsoft Defender for Cloud? (Choose two.)
⚠ Common exam trap
Test-takers frequently confuse Microsoft Defender for Cloud with other Microsoft security products like Defender for Endpoint (EDR), Defender for Cloud Apps (CASB), or Microsoft Sentinel (SIEM), because all are part of the Microsoft Security portfolio and often work together, but each has distinct primary capabilities.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Secure score and security recommendations
Microsoft Defender for Cloud provides a secure score and security recommendations (option A) as part of its Cloud Security Posture Management (CSPM) capabilities, continuously assessing resources against benchmarks like the Microsoft Cloud Security Benchmark and Azure Security Benchmark to surface prioritized remediation guidance. It also provides vulnerability assessment for VMs (option C) through integrated scanners such as Microsoft Defender for Servers' built-in vulnerability assessment powered by Qualys or the agentless scanning capability, surfacing CVEs and remediation steps in the portal. Option B (EDR) is a capability of Microsoft Defender for Endpoint, not Defender for Cloud itself, even though Defender for Servers can auto-provision the Defender for Endpoint agent. Option D (CASB) is delivered by Microsoft Defender for Cloud Apps, a separate product in the Defender suite. Option E (SIEM) is provided by Microsoft Sentinel, not Defender for Cloud.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Secure score and security recommendations
Why this is correct
Secure score quantifies posture against recommended controls, and security recommendations list specific remediation actions, satisfying the stem's requirement for Defender for Cloud capabilities. Both belong to the CSPM pillar, assessing configuration rather than detecting runtime threats.
- ✗
Endpoint detection and response (EDR)
Why it's wrong here
Defender for Cloud secures cloud workloads and posture; endpoint detection and response belongs to Microsoft Defender for Endpoint. It is tempting because Defender for Cloud's server protection plan surfaces endpoint alerts, but EDR telemetry, investigation and remediation actions are delivered by the endpoint product, not Defender for Cloud itself.
- ✓
Vulnerability assessment for VMs
Why this is correct
Vulnerability assessment scans virtual machines for missing patches and software flaws, satisfying the stem's requirement for a Defender for Cloud capability. It belongs to the workload protection pillar, examining installed components rather than resource configuration.
- ✗
Cloud Access Security Broker (CASB)
Why it's wrong here
CASB sits in Microsoft Defender for Cloud Apps, brokering SaaS access and enforcing session policies; Defender for Cloud instead delivers cloud security posture management and workload protection. It is tempting because both are Defender-branded cloud security services, but CASB is correct only for governing sanctioned and shadow SaaS application usage.
- ✗
Security Information and Event Management (SIEM)
Why it's wrong here
SIEM centralises log ingestion, correlation and alerting, which is Microsoft Sentinel's role, not Defender for Cloud's. It is tempting because Defender for Cloud surfaces security alerts and recommendations, but its posture management and workload protection do not deliver SIEM log analytics or custom detection rules.
Go deeper
Related to this question
Learn chapter
Microsoft Entra Global Secure Access
Key term
Cloud security posture management
Cloud security posture management is the continuous process of monitoring cloud environments to detect misconfigurations, compliance violations, and security risks, and automatically remediating them to maintain a strong security posture.
Key term
Defender for Cloud
Microsoft Defender for Cloud is a cloud security posture management (CSPM) and cloud workload protection platform (CWPP) that provides unified security management and threat protection across hybrid and multi-cloud environments.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,279 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.