Describe the capabilities of Microsoft security solutions →hardMultiple ChoiceObjective-mapped

SC-900 Practice Question: Describe the capabilities of Microsoft security solutions

Exhibit

Refer to the exhibit.
```json
{
  "Alert": {
    "AlertId": "alert-1234",
    "Title": "Suspicious sign-in from unfamiliar location",
    "Severity": "Medium",
    "Category": "Identity",
    "DetectionSource": "Microsoft Defender for Identity",
    "Entities": [
      {
        "Type": "account",
        "Name": "jdoe",
        "UPN": "jdoe@contoso.com"
      },
      {
        "Type": "ip",
        "Address": "203.0.113.5"
      }
    ]
  }
}
```

You are investigating an alert in Microsoft Defender XDR. Based on the exhibit, what is the primary detection source for this alert?

⚠ Common exam trap

Watch out — candidates often confuse Microsoft Defender XDR's unified alert interface with the underlying detection source, assuming that because the alert appears in the XDR portal, it must come from a more familiar product like Defender for Endpoint or Sentinel, rather than recognizing the identity-specific indicators (e.g., domain controller involvement, Kerberos anomalies) that point to Defender for Identity.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Microsoft Defender for Identity

The exhibit shows an alert from Microsoft Defender XDR with a detection source of 'Microsoft Defender for Identity'. Defender for Identity uses on-premises Active Directory signals and network traffic to detect identity-based threats like lateral movement, privilege escalation, and compromised credentials. The alert details indicate suspicious activity tied to an on-premises domain controller, which is the core focus of Defender for Identity.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Microsoft Sentinel
Why it's wrong here
Microsoft Sentinel is a Security Information and Event Management (SIEM) and Security Orchestration, Automation, and Response (SOAR) solution. While it aggregates and correlates security alerts from various sources, including Microsoft Defender XDR components, it does not generate the initial detection for an alert originating within the Defender XDR suite itself. Instead, it acts as a centralized platform for ingesting and analyzing these pre-existing alerts.
✗
Microsoft Defender for Endpoint
Why it's wrong here
Microsoft Defender for Endpoint (MDE) provides advanced threat protection, post-breach detection, automated investigation, and response capabilities for endpoints like workstations and servers. While a crucial part of the Defender XDR suite, its primary focus is on endpoint-specific activities, file behaviors, and network connections originating from devices. An alert related to identity compromise or suspicious authentication patterns would typically fall outside MDE's core detection scope.
✓
Microsoft Defender for Identity
Why this is correct
Microsoft Defender for Identity (MDI) is specifically designed to protect hybrid identity environments by monitoring Active Directory domain controllers and other identity infrastructure. It identifies, detects, and investigates advanced threats, compromised identities, and malicious insider actions directed at an organization's identity system. Therefore, an alert within Microsoft Defender XDR concerning identity-based attacks or suspicious authentication activities would originate directly from MDI's specialized detection capabilities.
✗
Microsoft Defender for Cloud Apps
Why it's wrong here
Microsoft Defender for Cloud Apps (MDCA), formerly Microsoft Cloud App Security, serves as a Cloud Access Security Broker (CASB) focused on discovering and controlling shadow IT, protecting sensitive information in the cloud, and defending against cyberthreats across all cloud apps. Its detection capabilities are centered on cloud application usage, data governance, and anomalous behavior within SaaS applications. An alert stemming from on-premises identity infrastructure or general endpoint activity would not be generated by MDCA.

Go deeper

SC-900 Practice Question: Describe the capabilities of Microsoft security solutions

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question