SC-100 Design security solutions for infrastructure Practice Question
You are designing a security solution for containers in Azure Kubernetes Service (AKS). The solution must scan container images for vulnerabilities before deployment and enforce runtime security. Which combination of Microsoft Defender for Cloud features should you enable?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Defender for Containers
Microsoft Defender for Containers (option A) is correct because it is the Defender for Cloud plan specifically designed for Kubernetes and container workloads, providing image vulnerability scanning in registries and at deployment, plus runtime threat detection for AKS clusters via the Defender sensor and admission control. It also delivers Kubernetes-native hardening recommendations and attack-path analysis, matching both the pre-deployment scanning and runtime enforcement requirements. Microsoft Defender for App Service (option B) protects web apps and App Service plans, not container images or AKS runtime. The regulatory compliance dashboard (option C) only reports against standards and does not perform vulnerability scanning or runtime protection. Microsoft Defender for Servers (option D) covers VMs and server OS workloads, not container image scanning or Kubernetes runtime security.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Microsoft Defender for Containers
Why this is correct
Defender for Containers is the dedicated plan that directly scans container images in ACR (and other registries) for vulnerabilities, provides Kubernetes runtime threat detection by analyzing audit logs and node telemetry, and gives by-pod recommendations and drift prevention. It is the only Microsoft Defender for Cloud plan that natively covers the full container lifecycle on AKS, including cluster, node, and workload visibility.
- ✗
Microsoft Defender for App Service
Why it's wrong here
Defender for App Service is scoped to protecting web apps hosted on App Service plans, using heuristics to spot attacks like SQL injection, brute force, or fileless execution on the underlying sandbox. It does not discover, scan, or monitor AKS clusters, container images, or pod workloads, so it could not satisfy the container security requirement.
- ✗
Microsoft Defender for Cloud regulatory compliance dashboard
Why it's wrong here
The regulatory compliance dashboard in Defender for Cloud is a reporting layer that maps Azure resources to standards like CIS, ISO 27001, and Azure Security Benchmark, showing scores and policies. It never performs vulnerability assessment or runtime threat detection; it simply tracks whether policies are met, so it provides no protection against active container exploits.
- ✗
Microsoft Defender for Servers
Why it's wrong here
Defender for Servers is designed for IaaS and Arc-enabled VMs, delivering Microsoft Defender for Endpoint integration, just-in-time VM access, and file integrity monitoring. While an AKS worker node is a VM, this plan only detects issues at the OS/host level and lacks Kubernetes-aware capabilities such as pod-level visibility, image scanning, and container runtime attack detection, so it is insufficient for the requested container-focused solution.
Go deeper
Related to this question
About these practice questions
This SC-100 question is part of Courseiva's 605-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-100 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-100 exam.