A free set of preconfigured security settings in Microsoft Entra ID: it requires all users to register for MFA, requires MFA for administrators, blocks legacy authentication, and protects privileged actions.
In SC-900 it is the answer for small organizations with free licenses. It can't coexist with Conditional Access policies: if you need custom policies, you use Conditional Access (Entra ID P1).
Security defaults is a concept that can show up on the exam. Check the full guide to see it in context.