hardMultiple ChoiceObjective-mapped
SC-100 Practice Question: Your organization, Contoso Ltd., is migrating its…
Your organization, Contoso Ltd., is migrating its on-premises workloads to Azure. The environment includes 200 virtual machines (VMs) running Windows Server and 50 VMs running Linux. You are responsible for designing the security infrastructure. The company has the following requirements: 1) All VMs must be protected against malware. 2) Security updates must be applied automatically to Windows VMs within 24 hours of release. 3) Linux VMs must receive critical security patches within 48 hours. 4) A central dashboard must provide visibility into the security posture of all VMs. 5) All VMs must be onboarded to Microsoft Defender for Cloud to enable advanced threat protection. 6) The solution must minimize administrative overhead. You have implemented the following: - All VMs are enrolled in Microsoft Defender for Cloud with the enhanced security features enabled. - Azure Update Manager is configured to schedule updates. - Microsoft Defender for Endpoint is installed on all Windows VMs. However, after a month, the security team reports that: - 50 Windows VMs did not receive security updates within 24 hours. - 10 Linux VMs have not received any patches. - The central dashboard shows that 30 VMs are not reporting their security status. - A malware outbreak occurred on 5 Windows VMs that were not protected by Defender for Endpoint. You need to identify the most likely root cause and recommend a corrective action.
⚠ Common exam trap
The trap here is that candidates often focus on configuration or policy gaps (like missing extensions or update schedules) instead of recognizing that all symptoms—missing updates, no reporting, and unprotected VMs—stem from a single underlying network connectivity issue.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Review the network security groups (NSGs) and firewall rules to ensure outbound connectivity to the required Microsoft endpoints for Microsoft Defender for Endpoint and Windows Update.
The symptoms—VMs missing updates, not reporting status, and lacking Defender for Endpoint protection—point to a connectivity failure. Microsoft Defender for Endpoint and Windows Update require outbound connectivity to specific Microsoft endpoints (e.g., *.endpoint.microsoft.com, *.update.microsoft.com). Without this, VMs cannot receive updates, report security posture, or download Defender definitions, directly explaining all reported issues.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Onboard the VMs to Azure Arc and enable the Azure Update Manager on all VMs via Arc.
Why it's wrong here
Azure Arc onboarding is intended for hybrid, on-premises, or multi-cloud servers to bring them under Azure management. Since these VMs already reside in Azure, Arc adds no value and does not alter network egress behavior. Azure Update Manager can be used directly on Azure VMs without Arc, and even if enabled, it would still require outbound connectivity to Microsoft endpoints for update payloads and Defender telemetry, which is the actual blocker.
- ✗
Implement Azure Policy to enforce that all VMs have the 'Deploy default Microsoft IaaS anti-malware extension for Windows' policy assigned and create a remediation task.
Why it's wrong here
This Azure Policy ensures the Microsoft IaaS anti-malware extension is installed on VMs. Even if the policy is already assigned and the extension is deployed, the scenario points to VMs not receiving updates and Defender not communicating, which is a network connectivity issue, not an installation issue. A remediation task will only install the extension or enforce its presence; it cannot open NSG rules or firewall routes. Without outbound access to endpoints like *.update.microsoft.com and Defender service endpoints, the extension will still fail to function.
- ✗
Configure Microsoft Entra Privileged Identity Management (PIM) to require approval for update deployments.
Why it's wrong here
Microsoft Entra Privileged Identity Management (PIM) provides just-in-time privileged access, approval workflows, and time-bound roles for Azure AD identities. It operates entirely within the identity and authorization plane and has no capability to orchestrate, approve, or push Windows Update deployments. The failure mode described involves VMs lacking network connectivity to Microsoft endpoints, which is unrelated to who is authorized to perform updates. Enabling PIM would therefore have zero effect on update delivery or Defender connectivity.
- ✓
Review the network security groups (NSGs) and firewall rules to ensure outbound connectivity to the required Microsoft endpoints for Microsoft Defender for Endpoint and Windows Update.
Why this is correct
Reviewing NSGs and firewall rules is correct because VMs require outbound connectivity to Microsoft endpoints for both Windows Update and Microsoft Defender for Endpoint cloud services. If egress is blocked, update scans fail, definition updates cannot download, and Defender for Endpoint sensors cannot upload machine telemetry or receive policy. The fix should ensure NSG rules and any network virtual appliance or firewall allow traffic to the service tags (e.g., WindowsUpdate, AzureFrontDoor, and Defender for Endpoint URLs/IPs). This directly addresses the root cause rather than layering management, policy, or identity tools.
Go deeper
Related to this question
About these practice questions
One of 208 original SC-100 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-100 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-100 exam.