Using Defender for Cloud to Identify VMs Missing System Updates
Your organization has implemented Microsoft Defender for Cloud to protect Azure resources. You are responsible for security posture management. You need to ensure that all Azure VMs have the latest security updates installed. You have enabled automatic VM patching via Azure Update Manager. However, some VMs are not receiving updates because they are not registered with the Update Manager. You need to identify which VMs are missing updates and ensure they are patched. What should you do?
Quick Answer
The correct answer is to use the Microsoft Defender for Cloud recommendation 'System updates should be installed on your machines' to identify VMs missing updates, then enable auto-patching for those VMs. This works because Defender for Cloud continuously assesses your Azure resources against security best practices, and this specific recommendation scans all VMs in your subscription—including those not yet registered with Azure Update Manager—to flag any missing system updates. On the SC-900 exam, this tests your understanding of Defender for Cloud’s role as a cloud security posture management (CSPM) tool, distinct from Azure Policy (which enforces rules but doesn’t directly report update status) or Update Manager (which only shows compliance for registered machines). A common trap is assuming security alerts handle patching, but alerts focus on threats, not missing updates. Memory tip: think of Defender for Cloud as the “spotlight” that finds unpatched VMs, then Update Manager as the “fixer” that applies the patches.
⚠ Common exam trap
SC-900 often tests the distinction between security recommendations and alerts, and between identification and remediation tools. Candidates may confuse Azure Policy with Update Manager or think that alerts cover missing updates, but the correct answer combines Defender for Cloud's recommendation for identification with Update Manager for remediation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use the Microsoft Defender for Cloud recommendation 'System updates should be installed on your machines' to identify VMs missing updates, then enable auto-patching for those VMs.
The Microsoft Defender for Cloud recommendation 'System updates should be installed on your machines' is specifically designed to assess the security update status of your VMs and identify which ones are missing patches. Once identified, you can enable auto-patching for those VMs through Azure Update Manager, ensuring they receive updates. This approach directly addresses the requirement to both identify and remediate unpatched VMs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create an Azure Policy to enforce automatic updates on all VMs.
Why it's wrong here
Azure Policy can enforce, but does not identify missing updates on unregistered VMs.
- ✓
Use the Microsoft Defender for Cloud recommendation 'System updates should be installed on your machines' to identify VMs missing updates, then enable auto-patching for those VMs.
Why this is correct
The Defender for Cloud recommendation 'System updates should be installed on your machines' surfaces VMs missing patches, including those unregistered with Update Manager. Enabling auto-patching for those VMs satisfies the stem's requirement that every Azure VM receives current security updates.
- ✗
Review Microsoft Defender for Cloud security alerts for 'Missing system updates'.
Why it's wrong here
Security alerts are for detected threats, not missing updates.
- ✗
Use Azure Update Manager's compliance view to export a list of VMs with missing updates.
Why it's wrong here
This only shows VMs already registered.
Go deeper
Related to this question
Learn chapter
Defender for Cloud Workload Protections
Key term
Microsoft Defender
Microsoft Defender is a suite of security products that protects devices, data, and identities from cyber threats like malware, phishing, and unauthorized access.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
This SC-900 question is part of Courseiva's 1,279-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SC-900
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Your organization uses Microsoft Defender for Cloud to protect Azure virtual machines. You need to ensure that critical vulnerabilities identified on the VMs are automatically remediated using a just-in-time patching mechanism. What should you configure?
easy- A.Enable adaptive application controls and just-in-time VM access in Defender for Cloud
- B.Deploy Microsoft Intune for update management
- C.Configure Azure Automation Update Management
- ✓ D.Enable Azure Update Manager
Why D: Azure Update Manager is a unified service that provides managed update capabilities for Azure VMs and Arc-enabled servers. It enables just-in-time patching by allowing you to schedule and apply critical updates as needed, automatically remediating vulnerabilities. In contrast, Adaptive application controls and just-in-time VM access in Defender for Cloud are security controls that reduce attack surface but do not apply patches. Intune is for endpoint management, and Azure Automation Update Management is a legacy solution being replaced by Azure Update Manager.
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.