SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
Which TWO of the following are features of Microsoft Defender for Cloud? (Choose two.)
⚠ Common exam trap
Many candidates confuse the SIEM and SOAR capabilities of Microsoft Sentinel with the CWPP and CSPM functions of Defender for Cloud, or they mistakenly associate data classification (Purview) with Defender for Cloud's security recommendations.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Cloud Workload Protection Platform (CWPP)
Microsoft Defender for Cloud is a Cloud Workload Protection Platform (CWPP) that provides unified security management and advanced threat protection for workloads running in Azure, on-premises, and other clouds. It also includes Cloud Security Posture Management (CSPM) capabilities, which continuously assess your environment against security benchmarks (e.g., CIS, NIST) and provide actionable recommendations to improve your security posture.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Data classification and labeling
Why it's wrong here
Data classification and labeling is a core capability provided by Microsoft Purview, specifically through Purview Information Protection. This service focuses on identifying, classifying, and protecting sensitive data across an organization's digital estate by applying labels for governance and compliance. Microsoft Defender products, in contrast, are primarily focused on threat protection and extended detection and response (XDR) across various domains, rather than data governance.
- ✗
Security Information and Event Management (SIEM)
Why it's wrong here
Security Information and Event Management (SIEM) capabilities are provided by Microsoft Sentinel, which is Microsoft's cloud-native SIEM and Security Orchestration, Automation, and Response (SOAR) solution. Sentinel is designed for large-scale data ingestion, advanced threat detection, proactive hunting, and automated response across an entire enterprise. While Microsoft Defender products generate security data, they feed into a SIEM like Sentinel for centralized analysis, rather than providing the SIEM functionality themselves.
- ✓
Cloud Workload Protection Platform (CWPP)
Why this is correct
Cloud Workload Protection Platform (CWPP) is a key feature of Microsoft Defender for Cloud. This capability provides comprehensive protection for diverse cloud workloads, including virtual machines, containers, databases, and storage, across multi-cloud and hybrid environments. Defender for Cloud offers vulnerability assessments, just-in-time access, adaptive application controls, and file integrity monitoring to secure these critical compute resources against threats.
- ✗
Mobile Threat Defense (MTD)
Why it's wrong here
Mobile Threat Defense (MTD) is primarily integrated with Microsoft Intune, which is part of Microsoft Endpoint Manager. While Microsoft Defender for Endpoint extends its protection to mobile devices, the comprehensive MTD solution for managing and protecting mobile devices from sophisticated threats, including app-based, network-based, and OS vulnerabilities, is orchestrated through Intune's device management and compliance policies. Intune leverages MTD to ensure mobile devices meet security standards before accessing corporate resources.
- ✓
Cloud Security Posture Management (CSPM)
Why this is correct
Cloud Security Posture Management (CSPM) is a fundamental capability offered by Microsoft Defender for Cloud. This feature continuously assesses the security configuration of cloud resources against industry benchmarks, regulatory standards, and organizational policies. Defender for Cloud identifies misconfigurations, provides actionable security recommendations, and helps organizations improve their overall security posture across multi-cloud and hybrid environments, ensuring compliance and reducing attack surface.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
SSE
SSE (Security Service Edge) is a cloud-centric security framework that converges web, cloud, and network security into a single edge service.
Key term
Microsoft Defender
Microsoft Defender is a suite of security products that protects devices, data, and identities from cyber threats like malware, phishing, and unauthorized access.
About these practice questions
This SC-900 question is part of Courseiva's 1,250-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.