mediumMultiple ChoiceObjective-mapped
SC-200 Practice Question: A security administrator wants to enable…
A security administrator wants to enable vulnerability assessment for all existing and future Azure virtual machines using the integrated Microsoft Defender Vulnerability Management solution. Which action should they take in Microsoft Defender for Cloud?
⚠ Common exam trap
Candidates often confuse enabling 'Microsoft Defender for Servers' (which provides general threat protection) with the separate 'Vulnerability assessment' toggle that must be explicitly checked to activate the integrated vulnerability scanning, leading them to select option D which only mentions enabling workload protection.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable 'Microsoft Defender for Servers' plan and check the 'Vulnerability assessment' option in the environment settings
To enable vulnerability assessment for all existing and future Azure VMs using the integrated Microsoft Defender Vulnerability Management solution, you must enable the 'Microsoft Defender for Servers' plan in Defender for Cloud and then check the 'Vulnerability assessment' option within the environment settings. This action activates the built-in, agentless vulnerability assessment engine that is part of Defender for Cloud, automatically scanning VMs without requiring additional agents or manual deployment.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enable 'Microsoft Defender for Servers' plan and check the 'Vulnerability assessment' option in the environment settings
Why this is correct
Enabling the Microsoft Defender for Servers plan at the subscription level activates the integrated Microsoft Defender Vulnerability Management (MDVM) solution, which is the default vulnerability assessment engine in Defender for Cloud. Checking the 'Vulnerability assessment' option in the environment settings auto-provisions this integrated scanner across every current and future VM without requiring manual agent installation. This ensures continuous coverage and management of vulnerabilities through Defender for Cloud's dashboards and recommendations.
- ✗
Install the Log Analytics agent and configure the Qualys connector on each VM
Why it's wrong here
This approach configures the third-party Qualys vulnerability assessment solution, which requires the Log Analytics agent as a transport layer and a separate Qualys connector per subscription, plus individual VM onboarding. The question specifically asks for the integrated Microsoft vulnerability assessment, which is part of the Defender for Servers plan and does not rely on third-party tools or additional connectors. Qualys also carries separate licensing and is not automatically applied to future VMs without further configuration.
- ✗
Create a policy assignment from the built-in initiative 'Enable Azure Monitor for VMs'
Why it's wrong here
The built-in initiative 'Enable Azure Monitor for VMs' deploys the Log Analytics agent and the Dependency agent to enable Azure Monitor's VM insights, including performance charts, map dependencies, and host health. It does not include any vulnerability scanning or integration with Defender for Cloud's vulnerability assessment engine. Assigning this initiative would therefore provide observability data but would leave VMs completely unprotected from a vulnerability assessment standpoint.
- ✗
Enable 'Servers' workload protection in Defender for Cloud and then manually deploy the VA agent to each existing VM using Azure Policy
Why it's wrong here
Although enabling the 'Servers' workload protection (another name for the Defender for Servers plan) is necessary, manually deploying the vulnerability assessment agent via Azure Policy is redundant and contrary to the integrated solution's design. When Defender for Servers is enabled, Defender for Cloud automatically provisions the integrated Microsoft Defender Vulnerability Management scanner to all applicable VMs, so a separate policy deployment is not required. Additionally, using Azure Policy to deploy an agent would typically be aimed at third-party VA solutions, not the native one, and could conflict with the auto-provisioning settings.
Go deeper
Related to this question
About these practice questions
This SC-200 question is part of Courseiva's 209-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SC-200
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A security administrator wants to enable vulnerability assessment for all existing and future Azure virtual machines in a subscription using the integrated Microsoft Defender Vulnerability Management solution. What is the recommended action in Microsoft Defender for Cloud?
medium- ✓ A.Enable the 'Vulnerability assessment for machines' component in the Defender for Servers plan settings within the subscription's pricing & settings page.
- B.Manually install the Microsoft Defender Vulnerability Management agent on each VM via an Azure Policy initiative.
- C.Create an Azure Policy that assigns the 'Configure machines to receive a vulnerability assessment provider' built-in policy to the subscription.
- D.Enable 'Vulnerability assessment for machines' in the Azure Security Benchmark compliance dashboard.
Why A: Enabling the 'Vulnerability assessment for machines' component in the Defender for Servers plan settings within the subscription's pricing & settings page automatically provisions the integrated Microsoft Defender Vulnerability Management (MDVM) solution to all existing and future Azure VMs without manual agent installation. This is the recommended and native method in Microsoft Defender for Cloud to enable vulnerability assessment at scale, leveraging the built-in Qualys or MDVM scanner that is managed by the platform.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.