SC-900 Practice Question: Describe the capabilities of Microsoft security solutions

Correct answer & explanation

Microsoft Defender XDR (E) is correct because it is the extended detection and response platform that natively correlates signals across email (Defender for Office 365), endpoints (Defender for Endpoint), identities (Defender for Identity), and cloud apps, providing unified detection and automated response. Microsoft Sentinel (D) is correct because it is a cloud-native SIEM/SOAR solution that ingests telemetry from email, endpoint, identity, and other sources via connectors, then uses analytics rules, fusion, and playbooks to detect and respond to threats across those domains. Microsoft Intune (A) is not correct because it is a mobile device and endpoint management (MDM/MAM) service for configuration and compliance, not a threat detection and response solution. Microsoft Defender for Cloud Apps (B) is not correct here because, although it is part of the Defender XDR suite, on its own it is a CASB focused on cloud app discovery, session control, and SaaS threat protection rather than covering email, endpoints, and identities. Microsoft Purview (C) is not correct because it is a data governance, compliance, and information protection suite (DLP, eDiscovery, sensitivity labels), not a cross-domain threat detection and response platform.