Courseiva
← SC-200
Full test
mediumMultiple ChoiceObjective-mapped

SC-200 Practice Question: A company uses Microsoft Defender for Cloud with…

A company uses Microsoft Defender for Cloud with Defender for Servers enabled. They also run SQL Server on Azure Virtual Machines (IaaS). The security team wants to enable Advanced Threat Protection (ATP) for these SQL Server IaaS instances to detect threats like SQL injection. What is the single most effective action to achieve this?

⚠ Common exam trap

It's easy for candidates to confuse the SQL IaaS Agent extension (which is needed for VM registration and management) with the actual security configuration required for ATP, leading them to select Option B instead of the subscription-level plan enablement in Option A.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Enable the Defender for SQL plan on the management group or subscription

The Defender for SQL plan in Microsoft Defender for Cloud provides Advanced Threat Protection (ATP) for Azure SQL Database, Azure SQL Managed Instance, and SQL Server on Azure VMs. Enabling this plan at the management group or subscription level automatically protects all current and future SQL Server IaaS instances within that scope, including threat detection for SQL injection attacks, without requiring per-VM agent installation.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • ✓

    Enable the Defender for SQL plan on the management group or subscription

    Why this is correct

    Enabling the Microsoft Defender for SQL plan at the management-group or subscription scope activates the security workload that includes advanced threat protection (ATP) for SQL Server instances running on Azure VMs. This is a subscription-level feature in Defender for Cloud: once enabled, Defender for SQL collects SQL audit logs, detects suspicious activity such as SQL injection and brute-force attacks, and can raise security alerts. It also enables vulnerability assessment without needing separate manual configuration on each VM. Therefore, the plan must be enabled at a central scope to achieve the desired protection across all SQL IaaS workloads.

  • ✗

    Install the SQL IaaS Agent extension on each VM

    Why it's wrong here

    The SQL IaaS Agent extension (often called the SQL VM extension) registers the SQL Server VM with the Microsoft SQL Server resource provider, enabling Azure features such as automated patching, backup, and portal management. Installing it does not itself turn on Defender for SQL's threat detection; the agent simply makes the VM manageable and attestable. If Defender for SQL is not enabled, the extension remains inactive for security analytics even though the VM appears in Defender for Cloud. Thus, agent installation is a prerequisite for integration but not a substitute for enabling the Defender for SQL plan.

  • ✗

    Configure a vulnerability assessment solution on each SQL Server

    Why it's wrong here

    Configuring a vulnerability assessment solution directly on each SQL Server covers only the scanning and reporting of security weaknesses (for example, missing patches or misconfigurations). It does not provide real-time anomaly detection, database-level threat alerts, or investigation steps—those capabilities come from the Defender for SQL plan's advanced threat protection. Furthermore, Defender for Cloud’s built-in vulnerability assessment is nested inside the Defender for SQL plan; enabling the plan at a management group or subscription automatically provisions the assessment, so manually configuring it on each VM is both duplicative and insufficient to enable ATP. For these reasons, vulnerability assessment alone does not meet the requirement.

  • ✗

    Enable Azure SQL Database Threat Detection policy

    Why it's wrong here

    Azure SQL Database Threat Detection policy (part of Microsoft Defender for Azure SQL) applies to PaaS Azure SQL Database, Managed Instance, and data warehouses, not to SQL Server installations on Azure VMs. The employee’s SQL Server is IaaS-based, so the relevant plan is Microsoft Defender for SQL with the 'SQL servers on machines' component, not the Azure SQL Database policy. Enabling the PaaS policy has no effect on SQL Server IaaS instances because they need their own Defender for SQL plan at the subscription or management group. Thus, this action is scoped to the wrong service.

About these practice questions

One of 209 original SC-200 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Same concept, more angles

1 more way this is tested on SC-200

These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.

Variation 1. A company uses Microsoft Defender for Cloud with enhanced security features enabled. They have several Azure virtual machines running SQL Server. The security team wants to enable advanced threat protection for their Azure SQL databases. What should they do?

medium
  • ✓ A.Enable Microsoft Defender for SQL on the subscription.
  • B.Enable Microsoft Defender for Servers on the subscription.
  • C.Enable Microsoft Defender for Database on the subscription.
  • D.Configure SQL Vulnerability Assessment in the Azure portal for each database.

Why A: Microsoft Defender for SQL (formerly Advanced Threat Protection for Azure SQL) is the specific plan that provides threat detection for Azure SQL databases, including SQL Server on Azure VMs. Enabling it at the subscription level ensures all existing and future Azure SQL databases under that subscription are protected, which is the recommended and most efficient approach.

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.