SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
Your company uses Microsoft 365 E5 and wants to provide a unified security dashboard showing alerts from endpoints, email, identity, and cloud apps. Which solution should you use?
⚠ Common exam trap
Test-takers frequently confuse Microsoft Sentinel (a SIEM) with Microsoft Defender XDR (a unified security operations platform), but Sentinel is for ingesting third-party and custom logs, whereas Defender XDR natively aggregates alerts from Microsoft 365 E5 workloads without extra licensing or setup.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Defender XDR portal (security.microsoft.com)
Microsoft Defender XDR portal (security.microsoft.com) aggregates alerts from endpoints (Microsoft Defender for Endpoint), email (Microsoft Defender for Office 365), identity (Microsoft Defender for Identity), and cloud apps (Microsoft Defender for Cloud Apps) into a single unified dashboard. This is the correct solution because it provides cross-domain correlation and a centralized view of security incidents across these Microsoft 365 E5 workloads without requiring additional licensing or data ingestion.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Microsoft Defender XDR portal (security.microsoft.com)
Why this is correct
The Microsoft Defender XDR portal, accessible at security.microsoft.com, is the centralized console for managing and responding to threats across an organization's entire digital estate. It provides a unified security dashboard by integrating signals from Microsoft Defender for Endpoint, Identity, Office 365, and Cloud Apps. This comprehensive view enables security analysts to correlate alerts, investigate incidents, and automate responses, making it the ideal solution for a unified security experience within Microsoft 365 E5.
- ✗
Microsoft Sentinel
Why it's wrong here
Microsoft Sentinel is a cloud-native Security Information and Event Management (SIEM) and Security Orchestration, Automation, and Response (SOAR) solution. While it can ingest security data from various sources, including Microsoft 365 Defender, and allows for custom dashboards, it is primarily an analytics platform for advanced threat hunting and incident response across an entire enterprise, not a pre-built, out-of-the-box unified security dashboard specifically for Microsoft 365 E5's native security alerts. Its purpose is broader and requires more configuration than the integrated Defender XDR portal.
- ✗
Microsoft Intune admin center
Why it's wrong here
The Microsoft Intune admin center is primarily focused on endpoint management, including mobile device management (MDM) and mobile application management (MAM). Its core functions involve deploying applications, enforcing device compliance policies, and configuring security settings on managed devices. While Intune contributes to endpoint security by ensuring devices are compliant and configured securely, it does not provide a unified dashboard for security alerts, incidents, or threat intelligence across the broader Microsoft 365 ecosystem.
- ✗
Microsoft Purview Compliance Portal
Why it's wrong here
The Microsoft Purview Compliance Portal is dedicated to managing an organization's compliance posture, data governance, and risk management. It provides tools for data loss prevention (DLP), eDiscovery, insider risk management, and information protection, ensuring data adheres to regulatory requirements and internal policies. While compliance is related to security, this portal does not offer a real-time, unified dashboard for active security alerts, threat investigations, or incident response, which are the primary functions of a security operations center.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Anti-phishing policy
An anti-phishing policy is a set of rules and technical controls that organizations use to detect, block, and respond to email or message-based attacks that trick users into revealing sensitive information.
Key term
Microsoft Defender for Endpoint
Microsoft Defender for Endpoint is a cloud-delivered enterprise-grade security platform that protects devices, servers, and networks from advanced cyber threats by combining antivirus, endpoint detection and response, and automated investigation and remediation.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.