You have an Azure virtual machine named VM1 that runs Windows Server. You plan to deploy a new line-of-business (LOB) application to VM1. You need to ensure that the application can create child…

Microsoft Defender Credential Guard protects NTLM password hashes and Kerberos Ticket Granting Tickets using virtualization-based security to prevent credential theft attacks, which is unrelated to allowing child process creation.

Microsoft Defender Application Control (WDAC) is used to control which applications are allowed to run on a system based on customizable policies, but it does not specifically manage an allowed application's ability to create child processes.

Microsoft Defender SmartScreen helps protect users from malicious websites and downloads by checking reputation, which has no bearing on an application's ability to create child processes.

Exploit protection, a component of Windows Defender, offers various system-level and program-specific mitigations against exploits, including controls over 'Child process creation.' If an application needs to create child processes, the Exploit protection settings can be adjusted (e.g., by ensuring 'Block child processes' is disabled or configured as an audit-only rule for the specific application) to allow this functionality. Configuring Exploit protection is the direct way to manage this behavior for applications.