SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
Your company uses Microsoft Defender for Endpoint. A report shows that several devices are missing critical security updates. What feature should you use to deploy the missing updates?
⚠ Common exam trap
Candidates often confuse TVM's vulnerability discovery capability with the actual deployment mechanism, assuming TVM can both find and install updates, when in fact it relies on Intune or Configuration Manager for remediation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Intune update rings for Windows
Microsoft Intune update rings for Windows allow you to configure and deploy Windows quality and feature updates to managed devices. Since the question specifies deploying missing security updates, update rings provide the policy-based mechanism to schedule and enforce installation of those updates across devices enrolled in Intune.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Microsoft Intune update rings for Windows
Why this is correct
Microsoft Intune update rings for Windows provide a cloud-based solution for managing and deploying Windows updates to organizational endpoints. These rings allow administrators to define a phased rollout strategy, ensuring that devices receive updates in a controlled manner, which is crucial for maintaining security and operational stability. When a report indicates a need for updates, Intune is the primary cloud-native tool to enforce and monitor their deployment across managed devices.
- ✗
Microsoft Defender for Endpoint's threat and vulnerability management (TVM)
Why it's wrong here
Microsoft Defender for Endpoint's Threat and Vulnerability Management (TVM) capability is designed to discover, prioritize, and remediate software vulnerabilities and misconfigurations across an organization's endpoints. While TVM provides critical insights into the security posture and recommends actions, its core function is to identify and report on vulnerabilities, not to directly deploy or manage the installation of operating system or application updates. It acts as an intelligence layer, informing where updates are needed.
- ✗
Microsoft Configuration Manager
Why it's wrong here
Microsoft Configuration Manager (formerly SCCM) is a robust on-premises solution for managing large numbers of Windows-based computers, including deploying software updates, operating systems, and applications. While highly capable of update deployment, its primary architecture is on-premises, requiring significant infrastructure. In scenarios where cloud-native management is preferred or the primary endpoint management solution is cloud-based (like Intune, often integrated with Defender for Endpoint), Configuration Manager would not be the primary choice for update deployment.
- ✗
Microsoft Update
Why it's wrong here
Microsoft Update is a service that provides updates for Windows operating systems and other Microsoft products directly to individual devices. It acts as a publishing and distribution channel, making updates available to client devices. However, Microsoft Update itself is not an administrative management tool that allows an organization to control, schedule, or report on the deployment of updates across a fleet of devices. It lacks the centralized control and policy enforcement capabilities required for enterprise-level update management.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Microsoft Defender
Microsoft Defender is a suite of security products that protects devices, data, and identities from cyber threats like malware, phishing, and unauthorized access.
Key term
Intune
Microsoft Intune is a cloud-based service that helps organizations manage their users' devices and applications, ensuring security and compliance without needing to own or control the physical hardware.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.