Using Defender for Cloud to Identify VMs Missing System Updates
Your organization has implemented Microsoft Defender for Cloud to protect Azure resources. You are responsible for security posture management. You need to ensure that all Azure VMs have the latest security updates installed. You have enabled automatic VM patching via Azure Update Manager. However, some VMs are not receiving updates because they are not registered with the Update Manager. You need to identify which VMs are missing updates and ensure they are patched. What should you do?
Quick Answer
The correct answer is to use the Microsoft Defender for Cloud recommendation 'System updates should be installed on your machines' to identify VMs missing updates, then enable auto-patching for those VMs. This works because Defender for Cloud continuously assesses your Azure resources against security best practices, and this specific recommendation scans all VMs in your subscription—including those not yet registered with Azure Update Manager—to flag any missing system updates. On the SC-900 exam, this tests your understanding of Defender for Cloud’s role as a cloud security posture management (CSPM) tool, distinct from Azure Policy (which enforces rules but doesn’t directly report update status) or Update Manager (which only shows compliance for registered machines). A common trap is assuming security alerts handle patching, but alerts focus on threats, not missing updates. Memory tip: think of Defender for Cloud as the “spotlight” that finds unpatched VMs, then Update Manager as the “fixer” that applies the patches.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use the Microsoft Defender for Cloud recommendation 'System updates should be installed on your machines' to identify VMs missing updates, then enable auto-patching for those VMs.
Microsoft Defender for Cloud provides the recommendation 'System updates should be installed on your machines' that identifies VMs missing updates, including those not registered with Azure Update Manager. Option A is incorrect because Azure Policy can enforce compliance but does not directly identify missing updates. Option C is incorrect because Azure Update Manager's compliance view shows update status for registered VMs but may not show unregistered VMs. Option D is incorrect because security alerts are for threats, not missing updates.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create an Azure Policy to enforce automatic updates on all VMs.
Why it's wrong here
Azure Policy can enforce, but does not identify missing updates on unregistered VMs.
- ✓
Use the Microsoft Defender for Cloud recommendation 'System updates should be installed on your machines' to identify VMs missing updates, then enable auto-patching for those VMs.
Why this is correct
This recommendation lists VMs missing updates.
- ✗
Review Microsoft Defender for Cloud security alerts for 'Missing system updates'.
Why it's wrong here
Security alerts are for detected threats, not missing updates.
- ✗
Use Azure Update Manager's compliance view to export a list of VMs with missing updates.
Why it's wrong here
This only shows VMs already registered.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Compliance
Compliance is the process of ensuring that an organization follows laws, regulations, standards, and internal policies that apply to its operations and data handling.
Key term
Policy
A policy is a set of rules or guidelines that defines how an organization manages, secures, and operates its IT systems and services.
About these practice questions
This SC-900 question is part of Courseiva's 1,250-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SC-900
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Your organization uses Microsoft Defender for Cloud to protect Azure virtual machines. You need to ensure that critical vulnerabilities identified on the VMs are automatically remediated using a just-in-time patching mechanism. What should you configure?
easy- A.Enable adaptive application controls and just-in-time VM access in Defender for Cloud
- B.Deploy Microsoft Intune for update management
- C.Configure Azure Automation Update Management
- ✓ D.Enable Azure Update Manager
Why D: Azure Update Manager is a unified service that provides managed update capabilities for Azure VMs and Arc-enabled servers. It enables just-in-time patching by allowing you to schedule and apply critical updates as needed, automatically remediating vulnerabilities. In contrast, Adaptive application controls and just-in-time VM access in Defender for Cloud are security controls that reduce attack surface but do not apply patches. Intune is for endpoint management, and Azure Automation Update Management is a legacy solution being replaced by Azure Update Manager.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.