SC-200 Practice Question: A company has Azure virtual machines running…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Enable Defender for Servers plan

  Why this is correct

  Enabling Defender for Servers activates the built-in vulnerability assessment that automatically deploys the Qualys agent extension to supported Windows Server VMs, discovering missing security updates and configuration vulnerabilities without additional licensing. This integration is native to Defender for Cloud, and once the plan is enabled, the assessment runs continuously, surfacing findings in the Security Center recommendations such as "Machines should have vulnerability findings resolved." It does not require manual installation of any separate agent or marketplace product.

• ✗

  Install the Log Analytics agent manually

  Why it's wrong here

  The Log Analytics agent (or its successor, the Azure Monitor agent) is designed purely for collecting logs, performance counters, and telemetry for analysis in Log Analytics workspaces and Microsoft Sentinel, not for executing vulnerability scans. Defender for Cloud's built-in vulnerability assessment relies on its own Qualys-based extension, which is separate and is deployed automatically when you enable Defender for Servers; manually installing the Log Analytics agent does not provision that scanner. Therefore, this action would not produce missing security update findings and is not a prerequisite for the built-in VA.

• ✗

  Configure a vulnerability assessment solution from Azure Marketplace

  Why it's wrong here

  While Azure Marketplace offers third-party vulnerability assessment solutions (e.g., Qualys, Rapid7, Tenable), these are optional integrations that require their own licenses and configuration in Defender for Cloud. The built-in vulnerability assessment included with Defender for Servers already covers missing security updates on Windows Server VMs, so purchasing and configuring an external solution is unnecessary for this requirement. Choosing a marketplace solution would add cost and complexity without providing a functional advantage over the native capability for detecting missing updates.

• ✗

  Enable the regulatory compliance dashboard

  Why it's wrong here

  The regulatory compliance dashboard in Defender for Cloud provides visibility into how well your environment aligns with standards like CIS, NIST SP 800-53, and the Azure Security Benchmark, based on existing security assessments. It does not perform or enable any vulnerability scanning on your VMs; it simply aggregates and displays data collected from assessments that already run, including the built-in VA if it is enabled. Thus, enabling this dashboard does not deploy any scanner agent or generate missing security update findings on its own.

Go deeper

Related to this question