SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
Your organization's security team wants to automatically investigate and respond to sophisticated email threats like business email compromise (BEC) without manual intervention. Which Microsoft 365 security solution should you use?
⚠ Common exam trap
A common mix-up: candidates confuse 'email threat protection' with 'endpoint' or 'identity' solutions, mistakenly thinking BEC is an identity attack rather than an email-specific social engineering threat.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Defender for Office 365
Microsoft Defender for Office 365 includes automated investigation and response (AIR) capabilities specifically designed to handle sophisticated email threats like business email compromise (BEC). It uses machine learning models and heuristics to detect BEC patterns—such as spoofed domains, compromised accounts, and social engineering—and can automatically trigger playbooks to contain, investigate, and remediate threats without manual intervention.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Defender for Cloud Apps
Why it's wrong here
Microsoft Defender for Cloud Apps (formerly Microsoft Cloud App Security) functions as a Cloud Access Security Broker (CASB). It provides deep visibility into cloud applications and services, identifies shadow IT, monitors user activity, and protects sensitive data across sanctioned and unsanctioned SaaS applications. While crucial for overall cloud security posture management and data governance, its primary focus is on securing access to and data within cloud apps, not on automatically investigating and responding to email-borne threats like Business Email Compromise (BEC).
- ✗
Microsoft Defender for Endpoint
Why it's wrong here
Microsoft Defender for Endpoint is an enterprise endpoint security platform designed to help organizations prevent, detect, investigate, and respond to advanced threats on devices. It provides next-generation protection, endpoint detection and response (EDR) capabilities, and automated investigation and remediation for endpoints such as workstations, servers, and mobile devices. Its comprehensive scope is limited to device-level security and does not extend to the investigation and response of email-specific threats or collaboration tool risks.
- ✗
Microsoft Defender for Identity
Why it's wrong here
Microsoft Defender for Identity (formerly Azure Advanced Threat Protection) is a cloud-based security solution that leverages on-premises Active Directory signals to identify, detect, and investigate advanced threats, compromised identities, and malicious insider actions. It focuses on protecting user identities and credentials from attacks like pass-the-hash or Golden Ticket, and detecting suspicious activities across the network. While vital for identity protection and detecting lateral movement, it does not provide automated investigation and response specifically for email-based threats or phishing campaigns.
- ✓
Microsoft Defender for Office 365
Why this is correct
Microsoft Defender for Office 365 is the specialized security solution designed to protect organizations from sophisticated threats in email, links, and collaboration tools like Microsoft Teams, SharePoint, and OneDrive. It offers advanced anti-phishing, anti-malware, and anti-spam capabilities, along with Safe Attachments and Safe Links to neutralize threats. Crucially, it includes Automated Investigation and Response (AIR) capabilities that automatically investigate and remediate email-borne threats such as Business Email Compromise (BEC), making it the correct choice for this scenario.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Microsoft Defender for Office 365
Microsoft Defender for Office 365 is a cloud-based email and collaboration security service that protects organizations against malicious threats like phishing, malware, and spam in email messages and Office 365 apps.
Key term
Microsoft Defender
Microsoft Defender is a suite of security products that protects devices, data, and identities from cyber threats like malware, phishing, and unauthorized access.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.