SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
A company uses Azure SQL Database for a critical line-of-business application. The security team wants to enable threat protection that specifically detects and alerts on SQL injection attempts and anomalous database access patterns. Which workload protection plan should they enable within Microsoft Defender for Cloud?
⚠ Common exam trap
Test-takers frequently confuse Azure Defender for SQL with Azure Defender for App Service, mistakenly thinking SQL injection is a web application attack, but SQL injection targets the database layer, which is protected by the SQL-specific plan, not the App Service plan.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Defender for SQL
Azure Defender for SQL is the correct workload protection plan because it is specifically designed to detect and alert on SQL injection attempts and anomalous database access patterns for Azure SQL Database. It uses Microsoft's threat intelligence and machine learning to monitor database activity, providing targeted alerts for SQL-specific threats, unlike other Defender plans that focus on different resource types.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure Defender for Servers
Why it's wrong here
Azure Defender for Servers is specifically designed to provide threat detection and advanced protection for Azure virtual machines, on-premises servers, and multi-cloud virtual machines. It focuses on OS-level vulnerabilities, endpoint protection, and network-level threats targeting the server infrastructure itself. This plan does not extend its protection to the managed service layer of Azure SQL Database, which requires specialized database-centric security monitoring.
- ✓
Azure Defender for SQL
Why this is correct
Azure Defender for SQL is the dedicated security solution tailored for Azure SQL Database, Azure SQL Managed Instance, and SQL servers on Azure VMs or hybrid environments. It offers comprehensive vulnerability assessments to identify misconfigurations and provides advanced threat protection to detect anomalous activities, including SQL injection attacks, brute-force attempts, and suspicious access patterns. This specialized plan ensures robust security for the database layer, safeguarding sensitive data.
- ✗
Azure Defender for App Service
Why it's wrong here
Azure Defender for App Service provides security for web applications and APIs hosted on Azure App Service plans, focusing on threats at the application layer. It detects malicious requests, web shell uploads, and other common web vulnerabilities that target the application code and runtime environment. This protection is distinct from securing the underlying data store, as it does not monitor or protect against database-specific threats like SQL injection directly within the SQL database itself.
- ✗
Azure Defender for Storage
Why it's wrong here
Azure Defender for Storage offers threat detection for Azure Blob storage, Azure Files, and Azure Data Lake Storage accounts. Its capabilities include identifying malware uploads, suspicious access patterns, and potential data exfiltration attempts on these specific object and file storage services. Azure SQL Database is a relational database service, not a general-purpose storage account, and therefore falls outside the scope of protection provided by Azure Defender for Storage.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
SQL injection
SQL injection is a web security vulnerability that allows an attacker to interfere with the queries an application makes to its database, often to read, modify, or destroy data.
Key term
Threat protection
Threat protection is the set of security measures and technologies used to detect, prevent, and respond to cyberattacks and unauthorized access to systems and data.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.