SC-200 Practice Question: A company has enabled Microsoft Defender for…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Vulnerability assessment recommendations

  Why this is correct

  In Microsoft Defender for Cloud, vulnerability assessment recommendations (such as 'Machines should have a vulnerability assessment solution' or 'A vulnerability assessment solution should be enabled on your virtual machines') are the actionable items that include a 'Fix' (remediation) option. When you trigger remediation on one of these recommendations, Defender for Cloud automatically deploys the integrated vulnerability assessment agent—either Qualys or Microsoft Defender Vulnerability Management—onto the target VMs. This makes the recommendations the specific mechanism for agent deployment, not the plan itself.

• ✗

  Defender for Servers plan

  Why it's wrong here

  Enabling the Defender for Servers plan (formerly Azure Defender for Servers) turns on advanced security capabilities like threat detection, file integrity monitoring, and just-in-time VM access. Although this plan includes access to vulnerability assessment capabilities, simply switching the plan on does not install any agent on your VMs. The actual deployment of the vulnerability assessment agent only occurs when you explicitly act on the related recommendations—for example, by clicking 'Fix' or initiating a remediation task.

• ✗

  Security policies

  Why it's wrong here

  Security policies in Defender for Cloud are built on Azure Policy and are designed to enforce compliance standards and audit resource configurations. They define rules and effects (e.g., Audit, Deny, DeployIfNotExists), but the policy definitions themselves are not the deployment tool. Even in the case of a DeployIfNotExists policy, the agent is deployed only after a remediation task is run from the corresponding recommendation; simply assigning the policy does not install agents automatically without that remediation step.

• ✗

  Workload protections

  Why it's wrong here

  Workload protections is a broad category in Defender for Cloud that groups the enhanced security plans for different resource types, such as servers, SQL, storage, and containers. It is essentially a dashboard and plan-management view rather than a single feature or toggle used for deploying agents. Enabling workload protections for a workload type simply activates the underlying paid plan (like Defender for Servers); the installation of vulnerability assessment agents still requires acting on the relevant recommendations, so workload protections is not the direct deployment mechanism in this scenario.