SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
Which TWO Microsoft security solutions can be used to centrally manage security policies across hybrid environments including on-premises and cloud? (Choose TWO.)
⚠ Common exam trap
Candidates often confuse Microsoft Defender for Cloud (a CSPM/CWPP solution) with Microsoft Defender for Cloud Apps (a CASB), or mistakenly think Microsoft Defender for Office 365 covers hybrid infrastructure policies, when it only protects Microsoft 365 workloads.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Sentinel
Microsoft Sentinel is a cloud-native SIEM (Security Information and Event Management) solution that provides centralized security analytics and threat intelligence across the entire enterprise, including on-premises and multi-cloud environments. It collects data from various sources via connectors (e.g., Azure Monitor Agent, Syslog, Windows Security Events) and allows security teams to manage policies, detect threats, and respond from a single pane of glass. This makes it a correct answer for centrally managing security policies across hybrid environments.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Microsoft Sentinel
Why this is correct
Microsoft Sentinel is a cloud-native Security Information and Event Management (SIEM) and Security Orchestration, Automation, and Response (SOAR) solution. It ingests security data from diverse sources, including Azure, other cloud providers, and on-premises infrastructure, enabling centralized threat detection, investigation, and automated response. This comprehensive capability makes it a primary tool for centralized security management across hybrid and multicloud environments.
- ✓
Microsoft Defender for Cloud
Why this is correct
Microsoft Defender for Cloud provides robust Cloud Security Posture Management (CSPM) and Cloud Workload Protection (CWP) across hybrid and multicloud environments. It offers continuous security assessments, recommendations, and advanced threat protection for servers, containers, databases, and other workloads running in Azure, AWS, GCP, and on-premises. This solution centralizes visibility into security posture and compliance, making it essential for managing security across diverse infrastructures.
- ✗
Microsoft Defender for Office 365
Why it's wrong here
Microsoft Defender for Office 365 is specifically designed to protect an organization's email, documents, and collaboration tools within the Microsoft 365 suite. It provides advanced threat protection against phishing, malware, and business email compromise for services like Exchange Online, SharePoint, OneDrive, and Microsoft Teams. However, its scope is limited to these specific productivity services and does not extend to providing centralized security management or threat protection for broader hybrid or multicloud infrastructure components.
- ✗
Microsoft Intune
Why it's wrong here
Microsoft Intune is a cloud-based unified endpoint management (UEM) solution focused on managing and securing mobile devices, desktop computers, and applications. It enforces device compliance, deploys applications, and manages configuration policies for endpoints, ensuring they meet organizational security standards. While crucial for endpoint security, Intune does not provide centralized security monitoring, threat detection, or posture management for server infrastructure, network devices, or cloud services across hybrid and multicloud environments.
- ✗
Microsoft Defender for Cloud Apps
Why it's wrong here
Microsoft Defender for Cloud Apps (formerly MCAS) functions as a Cloud Access Security Broker (CASB), providing visibility, control, and threat protection for an organization's cloud applications, particularly Software as a Service (SaaS) applications. It monitors user activity, detects anomalous behavior, and enforces data loss prevention policies within these apps. However, its focus is on application-level security and governance, not on providing centralized security management for underlying hybrid or multicloud infrastructure, virtual machines, or network components.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
SIEM
SIEM (Security Information and Event Management) is a system that collects and analyzes log data from across an IT environment to detect and respond to security threats in real time.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.