SC-900 Microsoft security solutions explained
Microsoft security solutions is the largest SC-900 skill area at 35–40%. It has four parts: core Azure infrastructure security services (DDoS Protection, Firewall, WAF, network segmentation, NSGs, Bastion, Key Vault), security management with Microsoft Defender for Cloud, Microsoft Sentinel as SIEM and SOAR, and the Microsoft Defender XDR family. The challenge is not depth but telling similar products apart, so learn each by the one problem it solves.
Core infrastructure security in Azure
| Service | What it does |
|---|---|
| Azure DDoS Protection | Defends public IP resources against volumetric and protocol denial-of-service attacks |
| Azure Firewall | Managed, stateful network firewall with application, network and threat-intelligence rules |
| Web Application Firewall (WAF) | Protects web apps from common attacks such as SQL injection and cross-site scripting, on Application Gateway or Front Door |
| Virtual networks and segmentation | Split workloads into isolated subnets to limit lateral movement |
| Network security groups (NSGs) | Allow or deny traffic by source, destination, port and protocol at the subnet or NIC |
| Azure Bastion | Browser-based RDP and SSH to VMs over TLS, without public IP addresses on the VMs |
| Azure Key Vault | Stores and controls access to secrets, keys and certificates |
An NSG is basic filtering; Azure Firewall is a full managed firewall; a WAF understands web traffic. If the scenario mentions SQL injection, the answer is WAF.
Security management: Defender for Cloud
Microsoft Defender for Cloud does cloud security posture management (CSPM): it assesses resources against security policies and standards, produces recommendations and a secure score, and highlights misconfigurations. Its enhanced workload protection plans add threat detection for servers, storage, databases and containers, including across other clouds and on-premises.
Microsoft Sentinel
Sentinel is a cloud-native SIEM (security information and event management: collect, correlate and detect) with SOAR (security orchestration, automation and response: playbooks that act automatically). It ingests data from many sources, uses analytics rules and machine learning to detect threats, supports hunting and incidents, and runs automation, such as disabling an account.
Microsoft Defender XDR
Defender XDR coordinates detection and response across products, with a single portal (the Microsoft Defender portal).
| Product | Protects |
|---|---|
| Defender for Office 365 | Email and collaboration: phishing, malicious attachments and links |
| Defender for Endpoint | Devices: endpoint detection and response, attack surface reduction |
| Defender for Cloud Apps | A cloud access security broker for SaaS: shadow IT discovery, app control |
| Defender for Identity | On-premises Active Directory signals: compromised identities, lateral movement |
| Defender Vulnerability Management | Finding and prioritizing vulnerabilities and misconfigurations |
| Microsoft Threat Intelligence | Research and intelligence on threat actors, to inform detection |
Do not confuse Defender for Cloud (Azure and multicloud resources) with Defender for Cloud Apps (SaaS applications).
Example questions
Question 1. A public web application behind Azure Application Gateway must be protected against SQL injection and cross-site scripting. Which service should be enabled?
- A. Azure DDoS Protection
- B. A network security group
- C. Azure Web Application Firewall
- D. Azure Bastion
Show answer
Answer: C
A web application firewall inspects HTTP traffic and blocks common web exploits such as SQL injection and cross-site scripting. DDoS Protection addresses volumetric attacks, not application-layer injection. An NSG filters by IP, port and protocol and cannot inspect request content. Azure Bastion is for remote administration.
Want more questions like this? Full SC-900 practice tests →
Question 2. A security team wants to discover which unsanctioned SaaS applications employees use and to control access to them. Which Defender product helps?
- A. Microsoft Defender for Endpoint
- B. Microsoft Defender for Cloud Apps
- C. Microsoft Defender for Identity
- D. Microsoft Defender for Office 365
Show answer
Answer: B
Defender for Cloud Apps is a cloud access security broker that discovers shadow IT and applies controls to SaaS apps. Defender for Endpoint protects devices. Defender for Identity monitors on-premises Active Directory. Defender for Office 365 protects email and collaboration content.
Want more questions like this? Full SC-900 practice tests →
Question 3. Administrators need to connect to Azure virtual machines over RDP from the Azure portal without assigning public IP addresses to the VMs. Which service should you use?
- A. Azure Bastion
- B. Azure Key Vault
- C. Azure Firewall
- D. Azure DDoS Protection
Show answer
Answer: A
Azure Bastion provides RDP and SSH through the portal over TLS to VMs that have no public IP. Key Vault stores secrets. Azure Firewall filters network traffic and does not provide remote sessions. DDoS Protection defends public endpoints against floods.
Want more questions like this? Full SC-900 practice tests →
Next, compliance solutions explained, then the cheat sheet for the product map.