SC-100 Certification Practice Question #225

Question

You have an Azure subscription. The subscription contains 100 virtual machines that run Windows Server. The virtual machines are managed by using Azure Policy and Microsoft Defender for Servers.

You need to enhance security on the virtual machines. The solution must meet the following requirements:

•	Ensure that only apps on an allowlist can be run.
•	Require administrators to confirm each app added to the allowlist.
•	Automatically add unauthorized apps to a blocklist when an attempt is made to launch the app.
•	Require administrators to approve an app before the app can be moved from the blocklist to the allowlist.

What should you include in the solution?

Accepted Answer

Every requirement maps to Defender for Servers adaptive application controls: it builds an allow list so only approved apps run, surfaces ML-recommended rules that administrators review/approve before enforcement, automatically alerts on and blocks unauthorized apps (effectively a blocklist) when launch is attempted, and requires admin action to move an app into the allowed set. The other options operate on Azure resource policy or Entra ID/OAuth application consent and do not control which executables run inside the VMs. Suggested Answer, the unanimous Most Voted (6), the Highly Voted comment, and MS Learn all agree, with no dissent, so confidence is high.

More SC-100 practice questions