Which capability is part of Microsoft Defender for Endpoint?

Endpoint detection and response (EDR)

Data loss prevention policy management

Conditional access policy creation

Which workload does Microsoft Defender for Office 365 primarily protect?

On-premises Active Directory domain controllers

Email and collaboration tools such as Exchange Online, SharePoint, OneDrive, and Microsoft Teams

A company uses several third-party SaaS applications. The security team wants to discover shadow IT usage, control access to these apps based on risk, and monitor for anomalous behavior within them. What should they use?

Microsoft Defender for Cloud Apps

Microsoft Defender for Identity

Microsoft Defender for Office 365

Microsoft Defender for Endpoint

A security operations team uses Microsoft Defender XDR and wants to create a custom detection that triggers when a user account is created and then used to sign in from a new device within 10 minutes. They need to write a query that runs across email, endpoint, and identity data. What should they use?

Microsoft Defender for Cloud Apps activity logs

Advanced hunting in the Microsoft Defender portal

Microsoft Defender for Endpoint's device timeline

Microsoft Defender for Identity's sensitive group reports

What is the primary role of Microsoft Defender for Identity?

To detect and investigate identity-based threats in on-premises Active Directory

To secure cloud applications and data

To protect email from phishing and malware

To manage endpoint vulnerability scanning

Microsoft Certified:Security, Compliance, and Identity Fundamentals

Domain 3Objective 4

Describe Threat Protection with Microsoft Defender XDR SC-900 Practice Questions (Page 3)

Part of the Describe the capabilities of Microsoft security solutions domain, which accounts for 35–40% of the SC-900 exam. Microsoft does not publish an official question count, but from its 45-minute exam (~20–30 total, ~7–12 in this domain), expect 2–3 from this objective — we provide 33 practice questions to prepare you well beyond it. (estimate)

33questions here

7free pages

8concepts

35–40%of the exam

Questions 11–15

11foundation · easy
Which capability is part of Microsoft Defender for Endpoint?
Select an answer first
12foundation · easy
Which workload does Microsoft Defender for Office 365 primarily protect?
Select an answer first
13application · medium
A company uses several third-party SaaS applications. The security team wants to discover shadow IT usage, control access to these apps based on risk, and monitor for anomalous behavior within them. What should they use?
Select an answer first
14expert · hard
A security operations team uses Microsoft Defender XDR and wants to create a custom detection that triggers when a user account is created and then used to sign in from a new device within 10 minutes. They need to write a query that runs across email, endpoint, and identity data. What should they use?
Select an answer first
15foundation · easy
What is the primary role of Microsoft Defender for Identity?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SC-900

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “SC-900” is a trademark of its owner, used for identification only.