easyMultiple ChoiceObjective-mapped
SC-200 Practice Question: Enable vulnerability scanning for Azure virtual…
A company wants to enable vulnerability scanning for Azure virtual machines using the integrated Microsoft Defender Vulnerability Management solution. What is the first step?
⚠ Common exam trap
A common mix-up: candidates assume a separate extension or agent must be installed (Option A) because they are familiar with traditional vulnerability scanning tools, but Microsoft Defender for Cloud's integrated solution is agentless and activated by enabling the 'Servers' plan.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable the 'Servers' plan in Defender for Cloud.
The first step to enable vulnerability scanning for Azure VMs using the integrated Microsoft Defender Vulnerability Management solution is to enable the 'Servers' plan in Defender for Cloud. This plan activates the Defender for Cloud integration with Microsoft Defender Vulnerability Management, which automatically discovers and assesses vulnerabilities on supported Azure VMs without requiring any additional agent or extension installation. Once the plan is enabled, vulnerability assessment is performed natively by the Defender for Cloud platform.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Install the Defender Vulnerability Management extension on each VM.
Why it's wrong here
The Defender Vulnerability Management extension is automatically provisioned when the Servers plan is enabled in Defender for Cloud, so manually installing it on each VM is redundant. Attempting to install it individually not only duplicates the auto-deployed solution but can also create configuration drift, and the manual install path isn't the intended method for activating scanning.
- ✓
Enable the 'Servers' plan in Defender for Cloud.
Why this is correct
Enabling the Servers plan in Microsoft Defender for Cloud is the required subscription-level action that activates the built-in vulnerability assessment for Azure VMs. This plan automatically deploys the Defender Vulnerability Management solution to both existing and newly created VMs, and the resulting scans are surfaced as recommendations and findings within Defender for Cloud. Without this plan enabled, there is no integrated vulnerability scanning available.
- ✗
Configure a vulnerability assessment solution in the VM's security settings.
Why it's wrong here
The VM's security settings blade does not contain a toggle or option to enable an integrated vulnerability assessment because that decision is made at the subscription level, not per VM. Each VM simply inherits the scanning solution that is enabled via the Servers plan in Defender for Cloud, so configuring a solution inside the VM's own security settings is not a valid path.
- ✗
Create a vulnerability assessment rule in Azure Policy.
Why it's wrong here
Creating a vulnerability assessment rule in Azure Policy can only audit or enforce that some solution is present, but it cannot activate Defender for Cloud's built-in vulnerability scanner. The scanner is a platform capability controlled by the Servers plan, and policy lacks the ability to deploy or enable that scanner on its own. The correct order is to enable the plan first and then use policy to verify or enforce compliance.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SC-200 question from scratch — 209 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.