Design solutions that align with security best practices and priorities →mediumMultiple ChoiceObjective-mapped
SC-100 Practice Question: Design solutions that align with security best practices and priorities
A company uses Microsoft Defender for Cloud to manage security across hybrid workloads. They need to ensure that all Azure VMs have guest-level threat detection enabled. Which security policy should they assign?
⚠ Common exam trap
A common mix-up: candidates confuse the deprecated 'Azure Security Benchmark' with the current 'Microsoft cloud security benchmark' or mistakenly think a compliance framework like NIST SP 800-53 can be directly assigned as a security policy in Defender for Cloud to enable technical controls like guest-level threat detection.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft cloud security benchmark
The Microsoft cloud security benchmark (MCSB) is the correct policy because it includes built-in guest-level threat detection recommendations for Azure VMs, such as deploying the Log Analytics agent and enabling Microsoft Defender for Servers with guest-level monitoring. This benchmark is the default initiative in Defender for Cloud and directly maps to the requirement of enabling guest-level threat detection across all VMs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure Security Benchmark
Why it's wrong here
Azure Security Benchmark is a policy initiative that covers a broad set of Azure security controls, but it does not specifically include a policy to deploy the Guest Configuration extension and enable guest-level threat detection. Its focus is on configuration and compliance of Azure resources, not on installing the agents that perform guest-level monitoring. Therefore, assigning this initiative alone does not satisfy the requirement to enable guest-level threat detection.
- ✓
Microsoft cloud security benchmark
Why this is correct
The Microsoft cloud security benchmark (MCSB) is the unified, built-in policy initiative that evolved from the Azure Security Benchmark and includes policies that deploy the Guest Configuration extension onto VMs and enable Microsoft Defender for Servers, which provides guest-level threat detection. When this initiative is assigned, its DeployIfNotExists policies automatically install required agents and extensions, directly fulfilling the stated requirement. Thus, it is the correct initiative for enabling guest-level threat detection.
- ✗
Microsoft Defender for Cloud Apps
Why it's wrong here
Microsoft Defender for Cloud Apps is a cloud access security broker (CASB) that provides visibility, data loss prevention, and threat protection for software-as-a-service (SaaS) applications, not an Azure Policy initiative. It does not contain policy definitions that deploy guest configuration extensions or enable guest-level threat detection on virtual machines, as those actions are handled by Defender for Cloud's workload protection policies. Therefore, it is incorrect for this requirement.
- ✗
NIST SP 800-53
Why it's wrong here
NIST SP 800-53 is a regulatory compliance framework that specifies security controls for federal information systems, but it is not a built-in policy assignment within Microsoft Defender for Cloud. Defender for Cloud offers a regulatory compliance dashboard that maps controls to NIST SP 800-53, but assigning this standard does not execute any deployment actions such as installing guest configuration extensions or enabling guest-level threat detection. Consequently, it cannot satisfy the technical requirement described in the question.
Go deeper
Related to this question
About these practice questions
One of 208 original SC-100 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-100 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-100 exam.