Many of the questions people miss on SC-900 are not about unknown concepts but about picking a similarly named service in place of the right one. There are more than seven products with Defender in the name, and three different features show security status as a score. When two answer choices come as a pair, such as Defender for Cloud and Defender for Cloud Apps, knowing each definition is not enough; you need to be able to state in one sentence what separates them.
This post is the review installment of the SC-900 study series. From the services explained in the domain posts, it picks only the groups that often appear as each other's wrong answers and reorganizes them by the criteria that separate them and the clue phrases that show up in questions.
---
Three Questions That Separate Look-Alike Services
When you meet two similar services, asking these three questions in order settles most cases.
| Question | What it separates | Example | |------|------|------| | What does it protect? | Target (people and identities; devices, mail, and apps; cloud infrastructure; data) | Entra ID Protection covers cloud sign-ins; Defender for Identity covers on-premises AD | | When does it act? | Timing (prevention, detection and response, after-the-fact investigation) | DLP stops a leak; audit records what happened | | Where does it live? | Environment (Azure resources, Microsoft 365, on-premises) | Defender for Cloud covers Azure resources; Defender for Cloud Apps covers SaaS apps |
Splitting by product family first makes it even easier. Microsoft's security and compliance products fall into four broad families, and each answers a different question and uses a different portal.
!Each product family answers a different question
---
Domain 1: Look-Alike Pairs in the Concepts
Authentication vs Authorization
| Aspect | Authentication (AuthN) | Authorization (AuthZ) | |------|------|------| | Question | Who are you? | What can you do? | | Order | First | After authentication | | Clue in the question | "Prove identity with a password and MFA" | "Allow read only," "assign an admin role" |
Zero Trust vs Defense in Depth
| Aspect | Zero Trust | Defense in depth | |------|------|------| | Nature | A security model (a way of thinking) | A security strategy (a way of stacking defenses) | | Core | Verify explicitly, use least privilege access, assume breach | Seven layers stacked from physical security to data | | Clue in the question | "Do not trust it even inside the network" | "If one layer is breached, the next one stops the attack" |
Encryption vs Hashing
| Aspect | Encryption | Hashing | |------|------|------| | Reversible? | Yes, decrypt with a key | No, one-way | | Used for | Hiding data so it cannot be read | Storing passwords, checking for tampering |
Related posts: Security, Compliance, and Identity Core Concepts, Encryption, Hashing, Identity Providers, and Directory Services Explained
---
Domain 2: Look-Alike Pairs in Microsoft Entra
Entra ID vs Active Directory Domain Services vs Entra Domain Services
| Aspect | Microsoft Entra ID | AD DS (on-premises) | Microsoft Entra Domain Services | |------|------|------|------| | Nature | Cloud identity service | Directory you run on your own servers | Domain services managed by Microsoft | | Main protocols | OAuth 2.0, OpenID Connect, SAML | Kerberos, NTLM, LDAP | Kerberos, NTLM, LDAP | | Clue in the question | "SSO to SaaS apps" | "Domain controllers," "Group Policy" | "Move legacy apps to the cloud without running domain controllers" |
Security Defaults vs Conditional Access vs ID Protection
| Aspect | Security defaults | Conditional Access | Microsoft Entra ID Protection | |------|------|------|------| | What it does | Turns on predefined baseline protection (MFA and more) for all users at once | Uses signals such as user, device, and location to allow, block, or require MFA in detail | Detects sign-in risk and user risk | | License | Free | Entra ID P1 | Risk-based policies need Entra ID P2 | | Clue in the question | "Baseline protection at no extra cost" | "Require MFA when connecting from outside the office" | "Leaked credentials," "sign-in from an anonymous IP" |
PIM vs Access Reviews vs Entitlement Management
| Aspect | PIM | Access reviews | Entitlement management | |------|------|------|------| | Core | Activates admin rights only for the time needed (just-in-time) | Periodically checks whether existing access is still needed | Lets users request and get approval for access packages that bundle what they need | | Clue in the question | "Global Administrator for two hours, with approval" | "Recheck guest access every quarter" | "An external partner requests all project resources at once" |
Entra Roles vs Azure RBAC
| Aspect | Microsoft Entra roles | Azure RBAC | |------|------|------| | What it manages | Entra ID itself (users, groups, app registrations) | Azure resources (VMs, storage, and so on) | | Typical roles | Global Administrator, User Administrator | Owner, Contributor, Reader |
Entra ID Protection vs Defender for Identity
ID Protection detects risk in cloud sign-ins, while Defender for Identity uses domain controller sensors to detect attacks on on-premises Active Directory (lateral movement, credential theft). If the question mentions "on-premises" or "domain controllers," the answer is Defender for Identity.
Related posts: Entra Authentication Methods, Password Protection, and Hybrid Identity, Access Management and Identity Governance
---
Domain 3: Look-Alike Pairs in the Security Solutions
NSG vs Azure Firewall vs WAF vs DDoS Protection
| Aspect | NSG | Azure Firewall | WAF | DDoS Protection | |------|------|------|------|------| | What it blocks | Traffic by IP address and port | Traffic across many VNets, centrally (FQDN filtering, threat intelligence) | Web attacks such as SQL injection and cross-site scripting | Attacks that flood a service with traffic | | Where it applies | Subnets, network interfaces | Managed firewall in a hub VNet | Application Gateway, Front Door | Public IPs in a virtual network | | Clue in the question | "Block port 3389 into a subnet" | "Control all outbound traffic centrally" | "OWASP threats against a web app" | "Massive traffic flood" |
Defender for Cloud vs Defender for Cloud Apps vs Defender XDR
| Aspect | Defender for Cloud | Defender for Cloud Apps | Defender XDR | |------|------|------|------| | What it protects | Infrastructure resources in Azure, AWS, GCP, and on-premises | SaaS apps employees use | Mail, devices, identities, and apps as a whole | | Key capability | Security posture management (CSPM) and workload protection (CWP) | CASB, shadow IT discovery | Groups alerts into incidents for detection and response | | Clue in the question | "Misconfigured VMs and storage" | "Unapproved cloud apps" | "One attack from phishing to account takeover" |
Microsoft Sentinel vs Defender XDR
Sentinel is a SIEM and SOAR that collects logs even from non-Microsoft firewalls, servers, and other clouds, while Defender XDR is an XDR that deeply correlates signals from the Microsoft Defender products. If you see "collect data from third-party sources too," the answer is Sentinel.
Three Kinds of Scores
| Score | Where | What it measures | |------|------|------| | Microsoft Secure Score | Defender portal | Security posture of Microsoft 365 identities, devices, and apps | | Secure score (Defender for Cloud) | Defender for Cloud | Security posture of cloud resources such as Azure | | Compliance score | Compliance Manager | Progress on improvement actions for regulations and standards |
Related posts: Microsoft Defender XDR Services Explained, Defender for Cloud: Security Policies, Standards, and Secure Score, Azure Security Services
---
Domain 4: Look-Alike Pairs in the Compliance Solutions
Service Trust Portal vs Compliance Manager
| Aspect | Service Trust Portal | Compliance Manager | |------|------|------| | Whose story | Evidence that Microsoft meets the regulations | Whether your organization meets them | | What it provides | Audit reports (SOC, ISO), trust documents | Assessments, improvement actions, compliance score |
Microsoft Priva, which handles privacy risk and data subject requests, can also appear among the answer choices. The October 2026 skills outline does not name Priva in its detailed items, but remember that it is the product for an organization's privacy handling risks.
Sensitivity Labels vs Retention Labels
| Aspect | Sensitivity label | Retention label | |------|------|------| | What it decides | Who can open it (encryption, watermarks) | How long to keep it and when to delete it | | Clue in the question | "Keep confidential documents from opening outside the company" | "Keep for seven years, then delete," "declare as a record" |
DLP vs Insider Risk Management vs Communication Compliance vs Information Barriers
| Feature | What it does | Clue in the question | |------|------|------| | DLP | Blocks or warns about sharing and sending that contains sensitive information | "Block email with credit card numbers sent outside" | | Insider risk management | Detects patterns of leak or theft risk in user activity | "A departing employee downloads files in bulk" | | Communication compliance | Detects inappropriate language or policy violations in message content | "Review harassment in Teams chats" | | Information barriers | Stops specific groups from communicating or sharing at all | "No Teams conversations between the investment and research teams" |
eDiscovery vs Audit
eDiscovery finds, places on hold, and exports content needed for lawsuits and investigations, while audit records and searches when users and admins did what. Audit (Standard) keeps records for 180 days, and Audit (Premium) keeps them for one year by default.
Related posts: Purview Data Classification, Sensitivity Labels, and Retention Labels Explained, Insider Risk, eDisc