You have an Azure subscription that contains the resources shown in the following table. You plan to enable Azure Defender for the subscription. Which resources can be protected by using Azure…

Question

Exhibits

Options

• AVM1, VNET1, storage1, and Vault1
• BVM1, VNET1, and storage1 only
• CVM1, storage1, and Vault1 only
• DVM1 and VNET1 only
• EVM1 and storage1 only

• A
  91% (29)
• B
  6% (2)
• E
  3% (1)

Explanation

Explanation

Option A is correct because Azure Defender (now part of Microsoft Defender for Cloud) provides protection across a wide range of Azure resource types, including Virtual Machines (VM1), Virtual Networks (VNET1), Storage Accounts (storage1), and Key Vaults (Vault1) - all of which have dedicated Defender plans available.

The distractors are wrong because they each incorrectly exclude one or more resource types that Azure Defender does support: options B, C, D, and E all omit at least one valid resource (e.g., Vault1 or VNET1), suggesting those resources lack coverage, which is false - Azure Defender has specific plans for Key Vault and network-layer protections.

Key insight: Azure Defender offers individual, toggleable plans for many resource types, including VMs, Storage, SQL, Kubernetes, Container Registries, App Service, Key Vault, and DNS/network layers - so when in doubt, assume broader coverage rather than narrower.

Memory tip: Think of Azure Defender as an "umbrella" - it stretches across all major Azure resource categories, not just compute. If you see a core Azure service type (VM, Storage, Key Vault, VNet), assume Defender has a plan for it unless told otherwise.

No community discussion yet for this question.