mediumMultiple ChoiceObjective-mapped
SC-200 Practice Question: A company runs SQL Server on Azure Virtual…
A company runs SQL Server on Azure Virtual Machines (IaaS). They want to enable Advanced Threat Protection (ATP) for these instances to detect SQL injection attempts. What must they do first?
⚠ Common exam trap
Watch out — candidates often confuse Azure Defender for Servers (which protects the OS) with Azure Defender for SQL (which protects the database engine), leading them to select the server-level plan when the question specifically asks for SQL injection detection.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable Azure Defender for SQL on the server
Azure Defender for SQL is the specific plan within Microsoft Defender for Cloud that provides Advanced Threat Protection (ATP) for Azure SQL resources, including SQL Server on Azure VMs. Enabling this plan activates threat detection capabilities such as SQL injection alerts, anomalous access patterns, and vulnerability assessments. Without this plan, the VM's SQL Server instance is not monitored by Defender for Cloud's SQL-specific threat detection engine.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Deploy the Azure Security Center agent on the VM
Why it's wrong here
The Azure Security Center agent, also known as the Log Analytics agent, is a prerequisite for many Defender plans but only collects host-level security events like process creation and registry changes. It does not enable any database-specific monitoring, and without the Defender for SQL plan enabled, there is no SQL injection detection or database anomaly alerting. The agent alone cannot inspect T-SQL query patterns or trigger alerts for malicious database activity.
- ✓
Enable Azure Defender for SQL on the server
Why this is correct
Enabling Azure Defender for SQL on the SQL Server VM activates Advanced Threat Protection (ATP), which surfaces SQL injection attempts, anomalous user logins, and brute-force attacks specific to the database engine. This plan integrates with the Log Analytics agent to evaluate SQL audit logs in real time and generates actionable security alerts. It is the only option that directly provides the SQL-specific threat detection required by the scenario.
- ✗
Enable Azure Defender for Servers
Why it's wrong here
Azure Defender for Servers is a host-level plan that secures the virtual machine's operating system by providing things like just-in-time administrative access, file integrity monitoring, and vulnerability assessments for the OS. It does not include any database-aware protections, so SQL injection attempts or other database-level attacks go undetected by this plan. To meet the demand for SQL-specific ATP, you must enable Defender for SQL separately rather than relying on Defender for Servers.
- ✗
Configure SQL Server auditing manually
Why it's wrong here
Manual SQL Server auditing writes event logs for defined actions, such as successful or failed logins and query executions, but it does not analyze those logs for threat patterns or emit alerts. Detecting SQL injection requires constructing complex predicates and building your own alerting system, which is prone to false positives and maintenance burden. In contrast, Defender for SQL applies Microsoft's threat intelligence to audit data to automatically detect and alert on suspicious database behavior.
Go deeper
Related to this question
About these practice questions
This SC-200 question is part of Courseiva's 209-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.