SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
You are the security administrator for a company using Microsoft Defender XDR. A user reports receiving a suspicious email with a link. What Microsoft Defender XDR feature should you use to investigate the email's threat level?
⚠ Common exam trap
Test-takers frequently confuse the broad 'Microsoft Defender XDR' umbrella with its specific components, mistakenly selecting a different Defender product (like Endpoint or Identity) instead of recognizing that email investigation is handled by the Email & collaboration workload within Defender for Office 365.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Email & collaboration in Microsoft Defender XDR
Microsoft Defender XDR's Email & collaboration feature (part of Defender for Office 365) is the correct tool for investigating a suspicious email. It provides a unified investigation experience, including threat explorer, email entity pages, and detonation analysis, allowing you to inspect the email's headers, attachments, URLs, and determine its threat level using Microsoft's threat intelligence and machine learning models.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Email & collaboration in Microsoft Defender XDR
Why this is correct
Email & collaboration in Microsoft Defender XDR provides robust, integrated protection for email and collaboration tools like Microsoft Teams, identifying and mitigating threats such as phishing, malware, and spam. It unifies threat investigation and response capabilities across these communication vectors within a single portal, enabling security administrators to proactively defend against sophisticated email-borne attacks and ensure data integrity.
- ✗
Microsoft Defender for Endpoint
Why it's wrong here
Microsoft Defender for Endpoint is specifically designed to protect endpoints, including workstations, servers, and mobile devices, by providing capabilities like Endpoint Detection and Response (EDR), vulnerability management, and next-generation antivirus. While crucial for overall organizational security posture, it does not directly secure email flow, detect email-specific threats, or manage email-borne attacks within mailboxes or email gateways.
- ✗
Microsoft Defender for Cloud Apps
Why it's wrong here
Microsoft Defender for Cloud Apps functions as a Cloud Access Security Broker (CASB), offering deep visibility, control over data travel, and sophisticated threat protection across various cloud applications, including SaaS, PaaS, and IaaS. Its primary focus is on securing access to and data within cloud services, identifying shadow IT, and enforcing compliance policies, rather than providing specialized protection for email communication systems themselves.
- ✗
Microsoft Defender for Identity
Why it's wrong here
Microsoft Defender for Identity specializes in protecting hybrid identity environments, encompassing both on-premises Active Directory and Azure Active Directory, from advanced identity-based threats. It detects suspicious user behaviors, credential theft attempts, and lateral movement techniques across the network, but it does not directly scan email content for malware or phishing links, nor does it manage email gateway security or mailbox protection.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Threat Explorer
A Microsoft 365 security tool that provides real-time interactive reports to investigate and analyze threats detected by Microsoft Defender for Office 365.
Key term
Microsoft Defender XDR
Microsoft Defender XDR is a unified security platform that automatically correlates alerts from across an organization's endpoints, email, identities, and cloud apps to stop complex attacks.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.