easyMultiple ChoiceObjective-mapped
SC-200 Practice Question: A security analyst reviews Microsoft Defender for…
A security analyst reviews Microsoft Defender for Cloud recommendations for an Azure virtual machine. The VM has a recommendation titled 'Install endpoint protection solution on virtual machines'. The analyst clicks on the recommendation and sees affected resources. Which of the following best describes the purpose of this recommendation in the context of Defender for Cloud?
⚠ Common exam trap
It's easy for candidates to confuse 'endpoint protection' with network-level controls (like NSG rules or Azure Firewall) or data-at-rest protections (like disk encryption), leading them to select options A, B, or C instead of recognizing the specific focus on malware protection at the OS level.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
It advises deploying a supported endpoint protection solution, such as Microsoft Defender Antivirus, to protect the VM from malware and other threats.
The recommendation 'Install endpoint protection solution on virtual machines' in Microsoft Defender for Cloud specifically identifies VMs that lack a supported endpoint protection solution (e.g., Microsoft Defender Antivirus, Trend Micro, Symantec). Its purpose is to ensure that VMs are protected against malware, viruses, and other threats by deploying an endpoint protection solution, which is a core security control in the cloud security posture management (CSPM) framework.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
It identifies VMs that have an open network security group inbound rule that should be closed.
Why it's wrong here
The 'Endpoint protection should be installed' recommendation evaluates whether a supported antimalware solution is active on the VM; it does not scan network security group rule configurations. Open inbound rules that should be closed are instead surfaced by network-specific recommendations such as 'All network ports should be restricted' or 'Management ports should be closed.' Relying on this recommendation for NSG changes would misattribute a network-layer exposure to a host-layer agent problem.
- ✗
It suggests enabling Azure Firewall on the virtual network to protect the VM from external threats.
Why it's wrong here
This recommendation does not propose deploying Azure Firewall, because Azure Firewall is a managed network firewall that filters north-south traffic at the virtual network edge. It cannot replace a host-based endpoint protection agent; the agent inspects local processes, file writes, and memory for malicious behavior. In Defender for Cloud, firewall deployment has its own network recommendations, for example 'All Internet-facing virtual machines should have Azure Firewall enabled,' which are distinct from the endpoint protection recommendation.
- ✗
It recommends enabling disk encryption for the VM's OS and data disks.
Why it's wrong here
Enabling disk encryption is handled by a separate Azure Disk Encryption recommendation that relies on BitLocker for Windows or DM-Crypt for Linux to protect data at rest. The endpoint protection recommendation instead checks the presence and health of an antimalware or endpoint detection and response agent on the VM. Even an encrypted VM remains vulnerable to malware if no endpoint protection agent is active, so encryption and endpoint protection are complementary but distinct controls.
- ✓
It advises deploying a supported endpoint protection solution, such as Microsoft Defender Antivirus, to protect the VM from malware and other threats.
Why this is correct
The correct recommendation prompts an analyst to deploy a supported endpoint protection solution, such as Microsoft Defender Antivirus or another integrated partner product, onto the VM. Defender for Cloud evaluates the VM's installed security agents and health state; if no solution is reported via the MMA/AMA or Microsoft Defender for Endpoint integration, it assigns the recommendation as 'unhealthy.' It can also detect a supported agent that is disabled, out-of-date, or reporting errors, and then direct the analyst to fix or provision the agent.
Go deeper
Related to this question
About these practice questions
This SC-200 question is part of Courseiva's 209-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.