SC-900 · Domain 3 of 4

SC-900 Domain 3: Describe the capabilities of Microsoft security solutions

The largest SC-900 domain: Azure infrastructure security services, Microsoft Defender for Cloud and posture management, Microsoft Sentinel as SIEM and SOAR, and the Microsoft Defender XDR family that protects email, endpoints, cloud apps and identities.

Exam weight
35–40%
Official functional groups
4
Estimated questions estimate
~19
Suggested study time estimate
8–12 hrs

About 13 min read Reviewed October 2026

Overview

Domain 3 is the heaviest part of SC-900 and spans four functional groups. Core infrastructure security in Azure covers DDoS Protection, Azure Firewall, Web Application Firewall, network segmentation with virtual networks, network security groups, Azure Bastion and Azure Key Vault. Security management covers Microsoft Defender for Cloud, cloud security posture management, how policies, standards and recommendations improve posture, and the enhanced features of cloud workload protection.

The Sentinel group defines SIEM and SOAR and describes threat detection and mitigation in Microsoft Sentinel. The Defender XDR group covers Defender for Office 365, Endpoint, Cloud Apps and Identity, Defender Vulnerability Management, Microsoft Threat Intelligence and the Microsoft Defender portal; the October 2026 update made a minor change here. At 35–40%, expect more questions from this domain than any other.

How it's tested

Questions in this domain describe a threat, an asset or an operational need and ask which Microsoft security service fits. Some focus on a single feature such as Secure Score or just-in-time VM access, while others compare two similar services. Look for the asset being protected, because that usually narrows the answer to one product.

  • Match the asset to the product

    An asset such as a mailbox, laptop, SaaS app, on-premises domain controller or Azure VM is described, and you pick the Defender product that protects it.

  • Network control choice

    A traffic requirement is stated, and you choose between NSGs, Azure Firewall, WAF, DDoS Protection or Bastion based on the layer and scope.

  • SIEM, SOAR or XDR

    A security operations need is described, such as collecting logs from many sources or running an automated playbook, and you choose Sentinel or Defender XDR.

Reasoning it through

A company wants administrators to reach Azure virtual machines over RDP without giving the VMs public IP addresses. An NSG can restrict traffic but still needs a reachable endpoint, and Azure Firewall filters network flows rather than brokering sessions. Azure Bastion provides browser-based RDP and SSH over TLS from the Azure portal to VMs with private addresses only, so Bastion meets the requirement directly.

Functional groups 4

Official functional groups from the Microsoft outline, in outline order.

3.1 Describe core infrastructure security services in AzureDDoS Protection, Azure Firewall, WAF, VNet segmentation, NSGs, Azure Bastion and Key Vault.
What it means
This group covers the Azure services that protect networks, management access and secrets, each operating at a different layer of a defense-in-depth design.
What to understand
Azure DDoS Protection mitigates volumetric and protocol attacks; every Azure resource gets basic infrastructure protection, and the paid tiers add tuning, telemetry and rapid response support for virtual networks or individual IPs. Azure Firewall is a managed, stateful firewall-as-a-service that filters traffic across virtual networks and subscriptions using threat intelligence. Web Application Firewall protects web apps against exploits such as SQL injection and cross-site scripting, running on Application Gateway or Azure Front Door. Virtual networks and subnets segment workloads, and NSGs filter inbound and outbound traffic with prioritized allow or deny rules based on source, destination, port and protocol. Azure Bastion gives RDP and SSH access without public IPs. Azure Key Vault stores secrets, keys and certificates securely.
How it shows up
Expect a protection need and a list of services, where you match the layer, such as web application, network flow or management access.
Common confusion
NSGs and Azure Firewall both filter traffic; NSGs are free, basic rule sets on subnets or interfaces, while Azure Firewall is a central, stateful managed service.
3.2 Describe security management capabilities of AzureMicrosoft Defender for Cloud, CSPM, policies and recommendations, and cloud workload protection.
What it means
This group explains how Microsoft Defender for Cloud measures and improves security posture across Azure, other clouds and on-premises, and how its workload protection plans add threat detection.
What to understand
Microsoft Defender for Cloud is a cloud-native application protection platform. Its cloud security posture management assesses resources continuously, shows Secure Score as a percentage, and provides recommendations to fix misconfigurations. Foundational CSPM is free, while Defender CSPM adds features such as attack path analysis and the cloud security explorer. Security policies and standards, such as the Microsoft cloud security benchmark and regulatory standards, define what is assessed, and the regulatory compliance dashboard shows status against them. Cloud workload protection plans, such as Defender for Servers, Storage, SQL, Containers and Key Vault, add threat alerts and hardening features like just-in-time VM access. Defender for Cloud covers multicloud and hybrid resources through connectors and Azure Arc.
How it shows up
Questions describe posture measurement or workload threat alerts and ask whether CSPM, Secure Score or a workload protection plan applies.
Common confusion
Defender for Cloud protects infrastructure and workloads, which differs from Defender for Cloud Apps, which protects SaaS app usage.
3.3 Describe capabilities of Microsoft SentinelSIEM and SOAR concepts and Sentinel threat detection and mitigation.
What it means
This group defines SIEM as collecting and analyzing security data and SOAR as automating response, and describes how Microsoft Sentinel delivers both as a cloud-native service.
What to understand
Security information and event management gathers logs from many sources, correlates them and raises alerts. Security orchestration, automation and response runs workflows that respond to threats consistently. Microsoft Sentinel collects data at cloud scale through data connectors, detects threats with analytics rules and Microsoft threat intelligence, investigates with incidents and investigation graphs, and responds using playbooks built on Azure Logic Apps and automation rules. Workbooks visualize data, hunting queries use Kusto Query Language, and notebooks support advanced analysis. Content hub solutions package connectors and rules. Sentinel can be onboarded to the Microsoft Defender portal for a unified security operations experience alongside Defender XDR.
How it shows up
You may be asked to define SIEM versus SOAR, or to name the Sentinel feature for automated response, hunting or visualization.
Common confusion
SIEM collects and correlates; SOAR acts. Playbooks are the SOAR part, not the detection part.
3.4 Describe threat protection with Microsoft Defender XDRDefender XDR services, the individual Defender products, Threat Intelligence and the Defender portal.
What it means
This group covers Microsoft Defender XDR as a unified extended detection and response suite that correlates signals from several Defender products into incidents, managed in the Microsoft Defender portal.
What to understand
Defender for Office 365 protects email and collaboration from phishing, malicious links and attachments with features such as Safe Links, Safe Attachments and attack simulation training. Defender for Endpoint protects devices with attack surface reduction, endpoint detection and response, and automated investigation. Defender for Cloud Apps is a cloud access security broker that discovers shadow IT and controls SaaS app sessions. Defender for Identity uses on-premises Active Directory signals to detect compromised identities and lateral movement. Defender Vulnerability Management finds and prioritizes weaknesses on devices. Microsoft Threat Intelligence provides context on threat actors and indicators. The Defender portal brings incidents, hunting, Secure Score and configuration into one place.
How it shows up
Expect an asset or attack type and a list of Defender products; match the one whose scope covers that asset.
Common confusion
Defender for Identity watches on-premises Active Directory, not Entra ID sign-in risk, which is ID Protection's job.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • Azure DDoS Protection

    Mitigates distributed denial-of-service attacks on Azure resources.

    Remember
    Paid tiers add telemetry and rapid response support.
    Tested as
    Availability attack scenarios.
    Trap
    Choosing WAF for a volumetric flood.

  • Azure Firewall

    Managed, stateful network firewall service.

    Remember
    Central filtering across VNets and subscriptions.
    Tested as
    Network filtering scenarios.
    Trap
    Confusing it with NSGs.

  • Web Application Firewall

    Protects web apps from common exploits.

    Remember
    Runs on Application Gateway or Front Door.
    Tested as
    SQL injection and XSS scenarios.
    Trap
    Expecting it to stop network-layer floods.

  • Network security group

    Allow or deny rules for subnets or NICs.

    Remember
    Rules are processed by priority.
    Tested as
    Basic filtering questions.
    Trap
    Thinking NSGs inspect application payloads.

  • Azure Bastion

    RDP and SSH over TLS without public IPs.

    Remember
    Accessed through the Azure portal.
    Tested as
    Secure management access scenarios.
    Trap
    Choosing a VPN for browser access to VMs.

  • Azure Key Vault

    Secure store for secrets, keys and certificates.

    Remember
    Centralizes and controls access to secrets.
    Tested as
    Credential storage questions.
    Trap
    Storing secrets in application code.

  • Secure Score

    Measures security posture as a percentage.

    Remember
    Higher is better; recommendations raise it.
    Tested as
    Posture measurement questions.
    Trap
    Confusing Defender for Cloud Secure Score with compliance score.

  • Cloud workload protection

    Defender plans that add threat detection for workloads.

    Remember
    Plans exist for servers, storage, SQL, containers and more.
    Tested as
    Threat alert scenarios.
    Trap
    Thinking free CSPM includes all workload alerts.

  • SIEM vs. SOAR

    Collect and correlate versus automate response.

    Remember
    Sentinel provides both.
    Tested as
    Definition questions.
    Trap
    Calling playbooks a detection feature.

  • Microsoft Sentinel playbooks

    Automated workflows built on Logic Apps.

    Remember
    Used to respond to incidents.
    Tested as
    Automation scenarios.
    Trap
    Confusing playbooks with workbooks.

  • Defender for Office 365

    Protects email and collaboration tools.

    Remember
    Safe Links and Safe Attachments.
    Tested as
    Phishing scenarios.
    Trap
    Choosing Defender for Endpoint for email threats.

  • Defender for Endpoint

    Endpoint protection, detection and response for devices.

    Remember
    Includes attack surface reduction.
    Tested as
    Device threat scenarios.
    Trap
    Confusing it with Defender Vulnerability Management alone.

  • Defender for Cloud Apps

    Cloud access security broker for SaaS apps.

    Remember
    Discovers shadow IT and controls sessions.
    Tested as
    SaaS usage scenarios.
    Trap
    Confusing it with Defender for Cloud.

  • Defender for Identity

    Detects threats using on-premises AD signals.

    Remember
    Spots lateral movement and compromised identities.
    Tested as
    Domain controller scenarios.
    Trap
    Expecting it to compute Entra sign-in risk.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Network protection services

ConceptMeaningKey differenceCommon trap
NSG Rule-based traffic filter on subnet or NIC Basic, distributed, no extra cost Expecting threat intelligence filtering
Azure Firewall Central stateful firewall service Spans VNets with threat intelligence Using it to block SQL injection
WAF Application-layer protection for web apps Inspects HTTP requests Expecting it to absorb volumetric floods
DDoS Protection Mitigates denial-of-service attacks Availability focus Thinking it filters application exploits

Defender for Cloud vs. Defender for Cloud Apps

ConceptMeaningKey differenceCommon trap
Defender for Cloud Posture and workload protection for infrastructure Protects Azure, multicloud and hybrid resources Using it to control SaaS sessions
Defender for Cloud Apps CASB for SaaS applications Discovers and governs app usage Using it to harden VMs

Sentinel vs. Defender XDR

ConceptMeaningKey differenceCommon trap
Microsoft Sentinel Cloud-native SIEM and SOAR Ingests data from many sources, including third parties Thinking it only reads Microsoft data
Microsoft Defender XDR Unified detection and response across Defender products Correlates native Defender signals into incidents Treating it as a log store for every source

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. Cloud versus Cloud Apps

    What candidates pick
    Pick Defender for Cloud to discover shadow IT.
    Why it looks right
    The names differ by one word.
    Why it's wrong
    Shadow IT discovery and SaaS session control belong to Defender for Cloud Apps, the CASB.

    Clue to watch for Unsanctioned apps, SaaS usage or session control.

  2. WAF for floods

    What candidates pick
    Choose WAF to stop a volumetric attack.
    Why it looks right
    Both protect web-facing services.
    Why it's wrong
    WAF inspects HTTP requests for exploits; volumetric and protocol floods are handled by DDoS Protection.

    Clue to watch for Traffic volume or availability is the problem.

  3. NSG for everything

    What candidates pick
    Choose NSGs for threat intelligence-based filtering.
    Why it looks right
    NSGs are the most familiar control.
    Why it's wrong
    NSGs apply simple rules; Azure Firewall adds stateful inspection and threat intelligence filtering centrally.

    Clue to watch for Threat intelligence or central policy is mentioned.

  4. Secure Score is compliance

    What candidates pick
    Treat Secure Score as a regulatory compliance result.
    Why it looks right
    Both are percentages.
    Why it's wrong
    Secure Score reflects security posture against recommendations; regulatory standards appear on a separate dashboard.

    Clue to watch for The question says regulation or standard.

  5. Sentinel only for Microsoft data

    What candidates pick
    Reject Sentinel for third-party firewall logs.
    Why it looks right
    It is a Microsoft product.
    Why it's wrong
    Sentinel data connectors ingest from many non-Microsoft sources, which is a core SIEM purpose.

    Clue to watch for Logs from several vendors must be correlated.

  6. Bastion is a VPN

    What candidates pick
    Choose VPN Gateway for portal-based RDP without public IPs.
    Why it looks right
    Both provide private access.
    Why it's wrong
    Bastion brokers RDP and SSH sessions through the portal over TLS; a VPN connects networks or clients.

    Clue to watch for Browser access and no public IP on the VM.

  7. Endpoint covers email

    What candidates pick
    Pick Defender for Endpoint for malicious attachments in mail.
    Why it looks right
    Attachments end up on devices.
    Why it's wrong
    Email filtering, Safe Attachments and Safe Links are Defender for Office 365 features.

    Clue to watch for Messages, links or Teams content.

Answer framework

For any Domain 3 product question, use these steps to narrow the options to one Microsoft security service.

  1. Identify the asset first: network, web app, VM, secret, Azure workload, email, device, SaaS app or on-premises identity.
  2. For network threats, separate application exploits (WAF), floods (DDoS Protection), central filtering (Azure Firewall) and simple rules (NSG).
  3. For posture and workload risk in Azure, multicloud or hybrid environments, choose Defender for Cloud and decide between CSPM and a workload protection plan.
  4. For collecting and correlating logs across many sources or running automated responses, choose Microsoft Sentinel as SIEM and SOAR.
  5. For user-facing assets, map email to Defender for Office 365, devices to Endpoint, SaaS to Cloud Apps and on-premises AD to Identity.

Practice question

A security team needs to collect logs from Microsoft 365, Azure resources and a third-party firewall, correlate them to detect attacks, and automatically disable a user account when a specific incident is created. Which Microsoft service best meets these requirements?

Want more like this? The SC-900 practice test has questions for every domain.

Checklist

0 of 14

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Give this domain the most time, around eight to twelve hours, because it carries the biggest weight. Split it into the four functional groups and finish each before moving on. For the infrastructure group, draw one Azure diagram that places DDoS Protection at the edge, WAF in front of a web app, Azure Firewall in a hub network, NSGs on subnets, Bastion for admin access and Key Vault for secrets.

For Defender for Cloud, learn the free and paid CSPM split, what Secure Score measures, and name three workload protection plans. For Sentinel, write out the collect, detect, investigate and respond cycle and attach the feature used at each stage.

The Defender XDR group is easiest as an asset map: one row per product with the asset it protects and one signature feature. Pay attention to the October 2026 change log, which updated this group, and use the current product names from the study guide. Spend the final sessions on mixed practice questions, since similar names cause most errors here.

FAQ

How much of SC-900 is Domain 3, Describe the capabilities of Microsoft security solutions?

Domain 3 is 35–40% of the exam, the largest share. It has four functional groups: Azure infrastructure security, Azure security management, Microsoft Sentinel and Microsoft Defender XDR.

Do I need to configure these services?

No. SC-900 is a fundamentals exam that asks you to describe capabilities. Knowing what each service protects and its main features is enough.

Is Microsoft Sentinel part of Defender XDR?

They are separate products that work together. Sentinel can be onboarded into the Microsoft Defender portal so analysts manage SIEM data and Defender XDR incidents in one place.

Which part of this domain did the October 2026 revision touch?

The change log marks a minor change to the Defender XDR group. Its bullets now list Defender XDR services, the four Defender products, Defender Vulnerability Management, Microsoft Threat Intelligence and the Defender portal.

What is the difference between Foundational CSPM and Defender CSPM?

Foundational CSPM is free and provides Secure Score and recommendations. Defender CSPM is a paid plan adding capabilities such as attack path analysis and the cloud security explorer.

Which Defender product watches domain controllers?

Microsoft Defender for Identity. It uses signals from on-premises Active Directory to detect reconnaissance, lateral movement and compromised identities.

Other Cybersecurity certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 3 knowledge

You have covered Azure network and secret protection, Defender for Cloud, Microsoft Sentinel and the Defender XDR products. Check that you can match each threat to the right service quickly.

Take the SC-900 practice test Check your SC-900 readiness

Keep going