SC-200 Practice Question: A company runs SQL Server on Azure Virtual…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Enable Microsoft Defender for SQL on the Azure subscription or at the SQL Server resource level.

  Why this is correct

  Enabling Microsoft Defender for SQL at the subscription or resource level is the action that activates the SQL-specific threat detection engine, which combines Advanced Threat Protection and vulnerability assessment for SQL Server on Azure VMs. This plan analyzes database telemetry and audit logs to raise alerts for SQL injection, brute-force attacks, and unusual access patterns. Subscription-level enablement ensures all existing and newly provisioned SQL resources are protected, while resource-level enablement scopes the same protections to a particular SQL Server instance.

• ✗

  Install the SQL Server IaaS Agent extension on each virtual machine.

  Why it's wrong here

  The SQL Server IaaS Agent extension registers the VM with the SQL Server resource provider and unlocks management conveniences such as license type changes, automated backup, and patch scheduling. It does not by itself enable Microsoft Defender for SQL; the separate Defender for SQL plan must be turned on, whether at subscription scope or on the SQL resource. While the extension may facilitate the Defender's collection of metadata, its presence alone produces no SQL injection or anomaly alerts.

• ✗

  Enable just Microsoft Defender for Servers on the subscription.

  Why it's wrong here

  Microsoft Defender for Servers safeguards the virtual machine at the operating system and hypervisor level, offering malware protection, endpoint detection, and OS vulnerability assessments. It lacks the database-aware sensors needed to inspect T-SQL queries, detect SQL injection patterns, or recognize database credential brute-force attempts. Consequently, relying solely on Defender for Servers leaves the SQL Server engine unmonitored for SQL-specific attacks and misses the Defender for SQL alerting that would otherwise be generated.

• ✗

  Configure an Azure SQL firewall rule to allow only trusted IP addresses.

  Why it's wrong here

  Azure SQL firewall rules are a network layer control that limits which client IP addresses can reach the SQL Server endpoint, thereby blocking unsolicited inbound traffic. They do not perform content inspection or behavioral analysis, so they cannot detect an attempted SQL injection that originates from an allowed IP address or from a compromised application account. Threat detection for such activity is only available through Microsoft Defender for SQL, which audits query patterns and login activities.

Go deeper

Related to this question