SC-100 Certification Practice Question #140

Question

A customer is deploying Docker images to 10 Azure Kubernetes Service (AKS) resources across four Azure subscriptions.
You are evaluating the security posture of the customer.
You discover that the AKS resources are excluded from the secure score recommendations.
You need to produce accurate recommendations and update the secure score.
Which two actions should you recommend in Microsoft Defender for Cloud? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.

Accepted Answer

The AKS resources are *excluded* from secure score, meaning Defender isn't assessing them. You first turn on the relevant Defender plan (Defender for Containers) — option A — and then configure auto provisioning so the Defender sensor and Azure Policy extension deploy to the clusters, which is exactly what generates Kubernetes posture recommendations and feeds the secure score (option B). MS Learn's "Enable the Defender for Containers plan" page documents both the plan toggle and the "Auto provision" components that produce posture assessments. The official Suggested Answer (B) captures only half, but the overwhelming community consensus (AB, 80 votes, both Highly Voted comments) plus a lab-tested confirmation make AB the complete solution. Minority AE/AD picks fail because inventory, compliance policies, and workflow automation don't onboard an excluded resource for assessment.

More SC-100 practice questions