Hotspot Question You have an Azure subscription named Sub1 that contains the resources shown in the following table. You need to enable Microsoft Defender for Cloud for storage accounts and virtual…

Question

Exhibits

Answer Area

• Storage accountsSubscription
  SubscriptionResource GroupResource
• Virtual machinesSubscription
  SubscriptionResource GroupResource

Explanation

This question tests knowledge of the granularity levels at which Microsoft Defender for Cloud can be enabled for storage accounts and virtual machines within an Azure subscription.

Approach. For storage accounts, Microsoft Defender for Cloud can be enabled at the subscription level or at the individual storage account level - meaning you can protect all storage accounts in a subscription at once, or selectively enable it per storage account resource. For virtual machines, Defender for Cloud (specifically Defender for Servers) can be enabled at the subscription level or at the individual server/VM level, allowing granular control. It cannot be enabled at the resource group level for either resource type - resource groups are not a supported scope for enabling Defender plans.

Concept tested. Microsoft Defender for Cloud plan enablement scopes - understanding that Defender for Storage can be enabled at the subscription level or individual storage account level, and Defender for Servers can be enabled at the subscription level or individual VM/server level, but neither supports resource group-level enablement as a distinct targeting scope.

Reference. https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-storage-introduction and https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers-select-plan

No community discussion yet for this question.