hardMultiple ChoiceObjective-mapped
SC-200 Practice Question: A security administrator wants to ensure that all…
A security administrator wants to ensure that all Azure virtual machines have Microsoft Defender for Cloud's vulnerability assessment (VA) solution enabled automatically. They need to deploy the VA solution to new and existing VMs without manual intervention. Which method should they use?
⚠ Common exam trap
Many exam-takers confuse enabling the Defender for Servers plan (which only activates the feature) with the automatic deployment mechanism provided by Azure Policy, leading them to select option C instead of the correct policy-based approach.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Assign an Azure Policy with DeployIfNotExists effect for the VA solution
Azure Policy with a DeployIfNotExists effect can automatically deploy the Microsoft Defender for Cloud integrated vulnerability assessment (VA) solution (Qualys or Microsoft) to both new and existing Azure VMs without manual intervention. This policy evaluates VMs that do not have the VA extension installed and triggers a remediation task to deploy it, ensuring continuous compliance across the subscription.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure 'Vulnerability assessment for machines' in Defender for Cloud settings
Why it's wrong here
Configuring 'Vulnerability assessment for machines' in Defender for Cloud settings only enables the integrated VA solution on machines that already have the Log Analytics agent or Azure Monitor Agent installed and reporting to the workspace. It does not evaluate which VMs lack the agent, nor does it trigger any deployment to unmonitored or newly created VMs, so a VM that is stopped, newly provisioned, or intentionally without an agent remains without vulnerability coverage.
- ✓
Assign an Azure Policy with DeployIfNotExists effect for the VA solution
Why this is correct
Assigning an Azure Policy definition that uses the DeployIfNotExists effect (such as the built-in 'A vulnerability assessment solution should be enabled on your virtual machines' initiative) guarantees enforcement at scale: after assignment, the policy identifies VMs without the VA solution and automatically deploys it using a managed identity for the deployment operations. Because policy evaluation runs on resource creation and during periodic compliance scans, both existing and newly created VMs are brought into compliance without manual intervention, providing continuous coverage.
- ✗
Enable the Defender for Servers plan on the subscription
Why it's wrong here
Enabling the Defender for Servers plan on the subscription turns on the broader Defender for Cloud protections—such as file integrity monitoring, just-in-time VM access, and Microsoft Defender for Endpoint integration—but does not itself install a vulnerability assessment solution on each VM. The plan is only a prerequisite that unlocks the integrated VA capability; without a separate DeployIfNotExists policy assignment, the plan leaves existing VMs that do not have the VA extension completely unprotected against missing vulnerability scans.
- ✗
Run a PowerShell script to install the VA solution on all VMs
Why it's wrong here
Running a PowerShell script to install the VA solution on all VMs would require manually enumerating the current inventory, establishing authentication to each VM, deploying the correct extension, and then re-running the script for every future VM; this is a one-time, imperative action that offers no continuous compliance or drift detection. In contrast, a DeployIfNotExists policy is declarative and automatically remediates non-compliant resources throughout the subscription lifecycle, making a script operationally brittle and unsuitable for ongoing enterprise compliance.
Go deeper
Related to this question
About these practice questions
One of 209 original SC-200 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.