easyMultiple Choice
SC-200 Practice Question: A company has enabled Microsoft Defender for…
A company has enabled Microsoft Defender for Cloud on its Azure subscription. The security team wants to ensure that all existing virtual machines have a vulnerability assessment solution installed. Which Defender for Cloud feature can automatically deploy a vulnerability assessment agent to supported VMs?
⚠ Common exam trap
It's easy for candidates to confuse the 'Defender for Servers plan' (which enables the feature set) with the actual automated deployment mechanism, assuming the plan itself installs agents, when in fact the deployment is triggered by enabling the 'Auto-provision' setting on the specific vulnerability assessment recommendation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Vulnerability assessment recommendations
The Vulnerability Assessment (VA) recommendations in Microsoft Defender for Cloud can automatically deploy a vulnerability assessment agent (such as the Qualys or Microsoft Defender Vulnerability Management agent) to supported Azure VMs. When a VM is found to be missing a VA solution, Defender for Cloud can enable the 'Auto-provision' setting for the VA recommendation, which triggers the agent installation without manual intervention. This directly meets the requirement to ensure all existing VMs have a vulnerability assessment solution installed.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Vulnerability assessment recommendations
Why this is correct
In Microsoft Defender for Cloud, vulnerability assessment recommendations (such as 'Machines should have a vulnerability assessment solution' or 'A vulnerability assessment solution should be enabled on your virtual machines') are the actionable items that include a 'Fix' (remediation) option. When you trigger remediation on one of these recommendations, Defender for Cloud automatically deploys the integrated vulnerability assessment agent—either Qualys or Microsoft Defender Vulnerability Management—onto the target VMs. This makes the recommendations the specific mechanism for agent deployment, not the plan itself.
- ✗
Defender for Servers plan
Why it's wrong here
Enabling the Defender for Servers plan (formerly Azure Defender for Servers) turns on advanced security capabilities like threat detection, file integrity monitoring, and just-in-time VM access. Although this plan includes access to vulnerability assessment capabilities, simply switching the plan on does not install any agent on your VMs. The actual deployment of the vulnerability assessment agent only occurs when you explicitly act on the related recommendations—for example, by clicking 'Fix' or initiating a remediation task.
- ✗
Security policies
Why it's wrong here
Security policies in Defender for Cloud are built on Azure Policy and are designed to enforce compliance standards and audit resource configurations. They define rules and effects (e.g., Audit, Deny, DeployIfNotExists), but the policy definitions themselves are not the deployment tool. Even in the case of a DeployIfNotExists policy, the agent is deployed only after a remediation task is run from the corresponding recommendation; simply assigning the policy does not install agents automatically without that remediation step.
- ✗
Workload protections
Why it's wrong here
Workload protections is a broad category in Defender for Cloud that groups the enhanced security plans for different resource types, such as servers, SQL, storage, and containers. It is essentially a dashboard and plan-management view rather than a single feature or toggle used for deploying agents. Enabling workload protections for a workload type simply activates the underlying paid plan (like Defender for Servers); the installation of vulnerability assessment agents still requires acting on the relevant recommendations, so workload protections is not the direct deployment mechanism in this scenario.
Go deeper
Related to this question
About these practice questions
This SC-200 question is part of Courseiva's 1,303-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.