SC-900 Practice Question: Describe the capabilities of Microsoft security solutions

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Obtain Microsoft 365 E3 licenses

  Why it's wrong here

  Microsoft Defender for Identity is not included in Microsoft 365 E3 licenses. To utilize Defender for Identity, an organization requires either a Microsoft 365 E5 license, an Enterprise Mobility + Security E5 license, or a standalone Microsoft Defender for Identity license. E3 licenses provide a foundational set of productivity and security features but do not encompass the advanced identity threat detection capabilities offered by Defender for Identity, which are reserved for higher-tier subscriptions.

• ✗

  Install a sensor on each user's workstation

  Why it's wrong here

  Installing a sensor on each user's workstation is incorrect for Microsoft Defender for Identity. Defender for Identity sensors are specifically designed to be deployed directly on domain controllers or dedicated servers monitoring network traffic from domain controllers. Their primary function is to capture and analyze authentication, authorization, and information requests directly from Active Directory, not individual endpoint activities.

• ✓

  Install a sensor on a domain controller

  Why this is correct

  Installing a sensor on a domain controller is the correct action for deploying Microsoft Defender for Identity. The Defender for Identity sensor passively monitors network traffic to and from the domain controller, as well as Windows events directly from the domain controller itself. This strategic placement allows it to detect suspicious activities, lateral movement paths, and advanced persistent threats targeting Active Directory, providing critical insights into identity-based attacks.

• ✗

  Configure Azure AD Connect

  Why it's wrong here

  Configuring Azure AD Connect is not a prerequisite or a direct component of deploying Microsoft Defender for Identity. Azure AD Connect is primarily used for synchronizing on-premises Active Directory identities with Azure Active Directory (now Microsoft Entra ID). While both services relate to identity, Defender for Identity operates by monitoring on-premises Active Directory traffic and events for threats, independently of whether those identities are synchronized to the cloud.

Go deeper

Related to this question