SC-100 Certification Practice Question #90

Question

You have a Microsoft 365 subscription and an Azure subscription. Microsoft 365 Defender and Microsoft Defender for Cloud are enabled.

The Azure subscription contains 50 virtual machines. Each virtual machine runs different applications on Windows Server 2019.

You need to recommend a solution to ensure that only authorized applications can run on the virtual machines. If an unauthorized application attempts to run or be installed, the application must be blocked automatically until an administrator authorizes the application.

Which security control should you recommend?

Accepted Answer

This is the canonical Microsoft Cloud Security Benchmark AM-5 scenario: only approved applications should run on Azure VMs and unauthorized software must be blocked. MS Learn explicitly names Microsoft Defender for Cloud adaptive application controls as the control that discovers running applications, machine-learning-generates an allowlist, and (in enforcement mode) blocks any application not on the list until an administrator adds it — exactly the requirement. Suggested Answer, a strong 7-vote community consensus, and two 4-👍 comments all align with the MS Learn guidance, and the other three options address identity or cloud-app governance rather than on-VM executable control. This question is the twin of question 44; the difference is that here the adaptive-application-controls option is present, making it the precise Microsoft-recommended answer rather than the MDE application-control fallback.

More SC-100 practice questions