SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
Your organization is using Microsoft Defender for Cloud to secure a multi-cloud environment including Azure and AWS. You need to identify misconfigurations that could lead to security breaches. Which feature should you use?
⚠ Common exam trap
Candidates often confuse the output (Security score) or a related feature (Regulatory compliance dashboard) with the core scanning mechanism (CSPM), or they mistakenly think CWP's runtime protection covers configuration auditing, when in fact CSPM is the dedicated feature for identifying misconfigurations.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Cloud Security Posture Management (CSPM)
Cloud Security Posture Management (CSPM) is the correct feature because it continuously assesses your multi-cloud environment (Azure and AWS) against security best practices and compliance frameworks, identifying misconfigurations that could lead to security breaches. In Microsoft Defender for Cloud, CSPM provides a unified view of security posture across clouds, detecting issues like open ports, weak encryption, or excessive permissions without requiring agents. This directly addresses the need to find misconfigurations that attackers could exploit.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Cloud Security Posture Management (CSPM)
Why this is correct
Cloud Security Posture Management (CSPM) continuously monitors cloud environments (IaaS, PaaS, SaaS) for misconfigurations, policy violations, and deviations from security best practices. It provides actionable recommendations to remediate identified issues, thereby proactively improving the overall security posture and reducing the attack surface. Microsoft Defender for Cloud's core CSPM capabilities include Secure Score, asset inventory, and security recommendations.
- ✗
Cloud Workload Protection (CWP)
Why it's wrong here
Cloud Workload Protection (CWP) focuses on protecting specific compute workloads, such as virtual machines, containers, and serverless functions, from active threats and vulnerabilities. While crucial for runtime protection, CWP's primary function is not to identify and recommend remediation for cloud resource misconfigurations across the entire environment, which is a posture management concern, but rather to detect and respond to malicious activity.
- ✗
Regulatory compliance dashboard
Why it's wrong here
The Regulatory compliance dashboard in Microsoft Defender for Cloud assesses an organization's adherence to specific industry standards and regulatory frameworks, such as ISO 27001, PCI DSS, or Azure Security Benchmark. It maps security recommendations to these controls, but its purpose is to report compliance status against predefined standards, not to broadly identify and manage all potential security misconfigurations across the cloud environment or provide general security recommendations.
- ✗
Security score
Why it's wrong here
The Secure Score in Microsoft Defender for Cloud is a dynamic, aggregated metric that quantifies an organization's security posture based on the number of resolved security recommendations. While it provides a high-level overview and helps prioritize improvements, the Secure Score itself does not directly identify individual misconfigurations; rather, it reflects the impact of remediating the underlying recommendations that detail those specific misconfigurations and contribute to the overall score.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Defender for Cloud
Microsoft Defender for Cloud is a cloud security posture management (CSPM) and cloud workload protection platform (CWPP) that provides unified security management and threat protection across hybrid and multi-cloud environments.
Key term
Encryption
Encryption is the process of converting readable data into a secret code to prevent unauthorized access.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.