mediumMultiple ChoiceObjective-mapped
SC-200 Practice Question: A security administrator needs to ensure that…
A security administrator needs to ensure that only approved applications can run on a set of Windows Server virtual machines. The administrator has already enabled Microsoft Defender for Cloud's enhanced security features. Which Defender for Cloud feature should the administrator configure to define a list of allowed applications and get alerts when unapproved applications are executed?
⚠ Common exam trap
Many exam-takers confuse 'application control' with 'file integrity monitoring' because both deal with files, but FIM only alerts on changes to existing files, not on execution of new unapproved applications.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Adaptive Application Controls
Adaptive Application Controls (AAC) is the correct feature because it uses machine learning to establish a baseline of known-safe processes on your Windows Server VMs, then enforces an allowlist so that only those approved applications can run. When an unapproved application is executed, AAC generates a security alert in Microsoft Defender for Cloud, meeting the requirement to both define allowed applications and receive alerts on violations.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Adaptive Application Controls
Why this is correct
Correct: Adaptive Application Controls, part of Microsoft Defender for Cloud, leverages machine learning to establish a baseline of normal application usage on each VM. It then creates an allowlist of known-good executables based on file provenance, path, and publisher, and triggers security alerts when an application outside that baseline attempts to run. Administrators can optionally enforce a deny rule to block such executions.
- ✗
File Integrity Monitoring (FIM)
Why it's wrong here
Incorrect: File Integrity Monitoring (FIM) focuses on detecting changes to critical system files, directories, and registry keys—such as modifications to boot configuration or sensitive binaries—and flags events like unauthorized modifications or attribute changes. It does not inspect process launches or evaluate the executables being invoked on a VM, so it cannot serve as an application allowlisting control.
- ✗
Just-in-Time VM Access (JIT)
Why it's wrong here
Incorrect: Just-In-Time VM Access (JIT) is a network-level control that restricts inbound traffic by opening specific ports (e.g., RDP 3389 or SSH 22) on NSGs only for an approved user and time window. This prevents brute-force attacks from the network but does not govern what software processes run locally on the VM, nor does it inspect the application binaries being executed.
- ✗
Vulnerability Assessment
Why it's wrong here
Incorrect: Vulnerability Assessment performs periodic scans of the VM operating system and installed software to identify missing patches, weak configurations, or known CVEs, and then reports the risk levels. It offers visibility into security weaknesses but does not enforce any runtime policy on application execution, as it is a passive auditing tool rather than an active allowlisting engine.
Go deeper
Related to this question
About these practice questions
One of 209 original SC-200 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.