SC-100 Design security solutions for infrastructure Practice Question
Your company plans to migrate on-premises servers to Azure. You need to ensure that the migrated servers are protected against malware and vulnerabilities. Which Microsoft Defender for Cloud plan should you enable for the Azure VMs?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Defender for Servers
Microsoft Defender for Servers (option D) is the correct choice because it is the Defender for Cloud plan specifically designed to protect Azure VMs and on-premises servers, providing threat detection, vulnerability assessment, and malware protection through integration with Microsoft Defender for Endpoint. It covers server workloads regardless of whether they run in Azure, other clouds, or on-premises, which matches the migration scenario. The other options target different resource types: Defender for SQL (A) protects Azure SQL and SQL Server workloads, Defender for Storage (B) protects Azure Storage accounts against threats like malware uploads and data exfiltration, and Defender for Containers (C) protects Kubernetes clusters and container registries, none of which address VM-level malware and vulnerability protection.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Defender for SQL
Why it's wrong here
Microsoft Defender for SQL is scoped to database workloads, providing vulnerability assessment, advanced threat protection, and auditing for Azure SQL Database, SQL Managed Instance, and SQL Server on Azure VMs. However, the scenario involves migrating general-purpose on-premises servers, which likely host a mix of applications, services, and operating system roles beyond just SQL Server. This plan does not offer broader server-level protections like endpoint detection and response or malware scanning for the entire VM, so it is not the correct choice.
- ✗
Microsoft Defender for Storage
Why it's wrong here
Microsoft Defender for Storage is dedicated to securing Azure Blob Storage, Azure Files, and Azure Data Lake Storage by detecting suspicious access patterns, malicious file uploads, and data exfiltration attempts. Since the migration plan concerns on-premises servers (compute infrastructure) rather than storage accounts, this plan would not protect the operating system, running processes, or installed software on the migrated VMs. Consequently, it is not suitable for this scenario.
- ✗
Microsoft Defender for Containers
Why it's wrong here
Microsoft Defender for Containers protects containerized environments, including Azure Kubernetes Service (AKS), Azure Container Instances, and container registries, with security for cluster nodes, runtime threat detection, and image scanning. The migration involves on-premises servers, which are traditionally deployed as virtual machines, not necessarily as container workloads; unless the organization explicitly rearchitects applications into containers, this plan would miss the actual VMs. Thus, it is not the appropriate protection plan for a straightforward server migration.
- ✓
Microsoft Defender for Servers
Why this is correct
Microsoft Defender for Servers is the correct plan because it is purpose-built for protecting Azure virtual machines and on-premises servers via Azure Arc, directly aligning with the migration of on-premises servers to Azure. It provides integrated Microsoft Defender for Endpoint for endpoint detection and response, malware scanning, vulnerability management, file integrity monitoring, and Just-in-Time (JIT) access controls. This comprehensive coverage ensures the migrated VMs maintain continuous security monitoring and threat protection across their entire workload.
Go deeper
Related to this question
About these practice questions
One of 605 original SC-100 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-100 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-100 exam.