Enabling Threat Detection for All Azure SQL Databases
A company uses Microsoft Defender for Cloud to secure their Azure workloads. They need to ensure that all Azure SQL databases have threat detection enabled. Which TWO actions should they take? (Choose two.)
Quick Answer
The answer is to enable Azure Defender for SQL at the subscription level and to ensure Microsoft Defender for Cloud has the Microsoft Defender for SQL plan enabled. This works because enabling the plan at the subscription scope automatically applies threat detection to all existing and future Azure SQL databases, centralizing security without requiring per-database configuration. On the Microsoft Cybersecurity Architect exam, this tests your understanding of Defender for Cloud’s policy-driven inheritance—a common trap is confusing individual database audit policies or Advanced Threat Protection settings with the subscription-level plan toggle. Remember that subscription-level enablement is the “master switch” for threat detection, while per-database settings like vulnerability assessments are separate features. A useful memory tip: think “Plan at the top, protection drops down”—if you enable the Microsoft Defender for SQL plan at the subscription level, threat detection cascades to every SQL database underneath.
⚠ Common exam trap
Candidates may incorrectly select Option A, thinking it covers Azure SQL Database, or Option C, confusing vulnerability assessment with threat detection. The correct approaches are subscription-level (B) or server-level (D) enablement.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable Azure Defender for SQL at the subscription level
The 'SQL servers on machines' plan applies to SQL Server instances on Azure VMs (IaaS), not to Azure SQL Database (PaaS). Option B is correct: enabling Azure Defender for SQL at the subscription level automatically enables threat detection for all Azure SQL databases in that subscription. Option C is incorrect: SQL Vulnerability Assessment identifies vulnerabilities but does not enable threat detection. Option D is correct: enabling Advanced Threat Protection on each SQL server individually also ensures threat detection for all databases on that server, though it is less efficient than subscription-level enablement. Option E is incorrect: SQL auditing is for compliance and auditing, not threat detection.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable Microsoft Defender for Cloud's 'SQL servers on machines' plan
Why it's wrong here
This option applies to SQL Server on Azure VMs (IaaS), not to Azure SQL Database (PaaS). It does not enable threat detection for the Azure SQL databases in question.
- ✓
Enable Azure Defender for SQL at the subscription level
Why this is correct
Enabling Azure Defender for SQL at the subscription level automatically enables Advanced Threat Protection for all Azure SQL databases in the subscription, ensuring threat detection across all databases.
- ✗
Configure SQL Vulnerability Assessment
Why it's wrong here
SQL Vulnerability Assessment is a separate feature that identifies and remediates potential vulnerabilities, but it does not enable threat detection.
- ✓
Enable Advanced Threat Protection on each SQL server individually
Why this is correct
Enabling Advanced Threat Protection individually on each SQL server ensures threat detection for all databases on that server. While less efficient than subscription-level enablement, it is a valid action to achieve the goal.
- ✗
Configure SQL auditing on each database
Why it's wrong here
SQL auditing tracks database events for compliance and auditing purposes, but does not provide threat detection.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
Courseiva writes every SC-100 question from scratch — 208 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on SC-100
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Your organization uses Microsoft Defender for Cloud to protect Azure workloads. You need to ensure that all Azure SQL Databases have Threat Detection enabled and Advanced Threat Protection notifications are sent to the security team. What should you do?
medium- ✓ A.Enable Advanced Threat Protection on the SQL Server and configure email notifications for all databases.
- B.Create an Azure Policy to audit Threat Detection settings and remediate non-compliant databases.
- C.Enable Threat Detection on each individual Azure SQL Database and set the email recipients in the server's diagnostic settings.
- D.Configure Microsoft Sentinel to monitor Azure SQL Databases and trigger alerts.
Why A: Enabling Advanced Threat Protection on the SQL Server applies to all databases, including future ones, and allows configuring email notifications for the security team. This is the most efficient and comprehensive approach. Option B (Azure Policy) can audit settings but cannot directly configure notifications. Option C (enabling on each database individually) is inefficient and does not cover new databases automatically. Option D (Microsoft Sentinel) is not required for this basic notification setup.
Variation 2. Your organization uses Microsoft Defender for Cloud to protect Azure SQL databases. You notice that a particular database is flagged with a high-severity recommendation to enable 'Advanced Data Security'. What does enabling Advanced Data Security provide?
hard- A.It restricts access to the database to specific IP addresses.
- B.It encrypts the database at rest using TDE.
- ✓ C.It provides vulnerability assessments and threat detection.
- D.It enables automatic backup encryption.
Why C: Advanced Data Security (ADS) includes vulnerability assessments, threat detection, and data discovery/classification. Option A is incorrect because restricting access to specific IP addresses is done via firewall or VNet rules, not by ADS. Option B is incorrect because transparent data encryption (TDE) is a separate feature for encryption at rest, not part of ADS. Option D is incorrect because backup encryption is handled by Azure Storage encryption, not ADS.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-100 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-100 exam.