|
| 1 | +### YamlMime:ModuleUnit |
| 2 | +uid: learn.wwl.enable-configure-workload-protection-plans.knowledge-check |
| 3 | +metadata: |
| 4 | + title: Knowledge check |
| 5 | + description: Check your knowledge of enabling and configuring workload protection plans in Microsoft Defender for Cloud. |
| 6 | + ms.date: 03/31/2026 |
| 7 | + author: r-c-stewart |
| 8 | + ms.author: roberts |
| 9 | + ms.topic: unit |
| 10 | + ai-usage: ai-generated |
| 11 | +title: Knowledge check |
| 12 | +durationInMinutes: 3 |
| 13 | +content: | |
| 14 | + [!include[](includes/6-knowledge-check.md)] |
| 15 | +quiz: |
| 16 | + title: Check your knowledge |
| 17 | + questions: |
| 18 | + - content: "Your organization deploys Azure OpenAI Service and Azure AI Model Inference service to power a customer-facing assistant. Which Defender for Cloud plan provides real-time threat protection against prompt injection and jailbreak attacks targeting these AI applications?" |
| 19 | + choices: |
| 20 | + - content: "Defender Cloud Security Posture Management (CSPM)" |
| 21 | + isCorrect: false |
| 22 | + explanation: "Incorrect. Defender CSPM provides posture management, attack path analysis, and risk prioritization—not runtime threat detection for AI workloads. Enabling Defender CSPM improves your AI security posture but doesn't generate real-time alerts for prompt injection or jailbreak attempts." |
| 23 | + - content: "Defender for AI Services" |
| 24 | + isCorrect: true |
| 25 | + explanation: "Correct. Defender for AI Services provides real-time threat protection for Azure OpenAI Service and Azure AI Model Inference service deployments. It detects threats specific to AI systems, including prompt injection attacks, jailbreak attempts, and sensitive data anomalies in model responses." |
| 26 | + - content: "Defender for App Service" |
| 27 | + isCorrect: false |
| 28 | + explanation: "Incorrect. Defender for App Service protects web applications and APIs hosted on the Azure App Service platform. It detects web application threats such as suspicious command execution and dangling DNS entries, but it doesn't provide protection for Azure OpenAI or Azure AI Foundry workloads." |
| 29 | + - content: "Defender for Resource Manager" |
| 30 | + isCorrect: false |
| 31 | + explanation: "Incorrect. Defender for Resource Manager monitors Azure management plane operations for suspicious activity such as lateral movement via Azure Resource Manager calls and cryptomining. It doesn't provide threat detection for AI workloads running on Azure OpenAI or Azure AI Foundry." |
| 32 | + - content: "You enable Defender for Storage on a subscription containing five Azure Blob Storage accounts. Which statement correctly describes the protection layers and their costs?" |
| 33 | + choices: |
| 34 | + - content: "Activity monitoring starts automatically for all storage accounts when the plan is enabled; malware scanning is a configurable add-on charged per gigabyte of data scanned." |
| 35 | + isCorrect: true |
| 36 | + explanation: "Correct. Activity monitoring is included as part of the Defender for Storage plan and starts automatically without extra configuration. Malware scanning is an optional add-on that you enable separately and is billed per gigabyte of uploaded data scanned, with a configurable monthly cap." |
| 37 | + - content: "Activity monitoring requires you to enable diagnostic logs on each storage account before threat detection begins." |
| 38 | + isCorrect: false |
| 39 | + explanation: "Incorrect. One of the key benefits of Defender for Storage is that activity monitoring analyzes data and control plane data without requiring diagnostic logs to be enabled. Protection begins automatically when the plan is turned on." |
| 40 | + - content: "Malware scanning is included at no extra cost as part of the base Defender for Storage plan." |
| 41 | + isCorrect: false |
| 42 | + explanation: "Incorrect. Malware scanning is a configurable add-on for Defender for Storage that is charged per gigabyte of uploaded data scanned. Malware scanning isn't included in the base plan cost. Activity monitoring and sensitive data threat detection are included, but malware scanning requires extra budget consideration." |
| 43 | + - content: "Sensitive data threat detection requires a separate Defender CSPM plan to be enabled on the subscription." |
| 44 | + isCorrect: false |
| 45 | + explanation: "Incorrect. Sensitive data threat detection is a configurable feature within the Defender for Storage plan itself and doesn't require Defender CSPM. You can enable or disable it within the Defender for Storage plan settings at no extra cost." |
| 46 | + - content: "Contoso Financial Services needs to enable just-in-time (JIT) VM access and file integrity monitoring on a group of production servers to meet their internal security policy. Which Defender for Servers plan provides both of these features?" |
| 47 | + choices: |
| 48 | + - content: "Plan 1 (P1)" |
| 49 | + isCorrect: false |
| 50 | + explanation: "Incorrect. Defender for Servers Plan 1 provides Microsoft Defender for Endpoint integration, core vulnerability assessment, and security alerts. Just-in-time VM access and file integrity monitoring are exclusive to Plan 2." |
| 51 | + - content: "Plan 2 (P2)" |
| 52 | + isCorrect: true |
| 53 | + explanation: "Correct. Defender for Servers Plan 2 includes all Plan 1 capabilities plus just-in-time VM access, file integrity monitoring, network map, agentless scanning, and 500-MB free daily data ingestion per server. Both features required by Contoso are exclusive to Plan 2." |
| 54 | + - content: "Either Plan 1 or Plan 2—both plans include just-in-time VM access and file integrity monitoring." |
| 55 | + isCorrect: false |
| 56 | + explanation: "Incorrect. Just-in-time VM access and file integrity monitoring are only available in Defender for Servers Plan 2. Plan 1 provides foundational endpoint detection and vulnerability management but doesn't include these advanced server protection features." |
| 57 | + - content: "Foundational CSPM—these features are part of posture management and don't require a CWPP plan." |
| 58 | + isCorrect: false |
| 59 | + explanation: "Incorrect. Just-in-time VM access and file integrity monitoring are workload protection features provided by Defender for Servers Plan 2, not posture management features. Foundational CSPM provides recommendations and secure score but doesn't include runtime workload protection capabilities." |
| 60 | + - content: "After enabling Defender plans across 14 subscriptions in a management group, your CISO asks for a consolidated report showing exactly which protection plans are active for each subscription. Which Defender for Cloud capability provides this view?" |
| 61 | + choices: |
| 62 | + - content: "Regulatory compliance dashboard" |
| 63 | + isCorrect: false |
| 64 | + explanation: "Incorrect. The regulatory compliance dashboard shows your organization's compliance posture against assigned security standards and frameworks. It doesn't provide a consolidated view of which Defender plans are enabled across subscriptions." |
| 65 | + - content: "Cloud Security Explorer" |
| 66 | + isCorrect: false |
| 67 | + explanation: "Incorrect. Cloud Security Explorer is a graph-based query tool for proactively hunting security risks across your environment. It's used to build custom queries about resource configurations and exposures, not to audit which protection plans are enabled." |
| 68 | + - content: "Coverage workbook" |
| 69 | + isCorrect: true |
| 70 | + explanation: "Correct. The Coverage workbook in Defender for Cloud shows which plans are enabled across all subscriptions and resources in a consolidated view. It's the purpose-built audit tool for understanding your Defender plan coverage, accessible through Defender for Cloud > Workbooks > Coverage." |
| 71 | + - content: "Microsoft Defender XDR incidents dashboard" |
| 72 | + isCorrect: false |
| 73 | + explanation: "Incorrect. The Microsoft Defender XDR incidents dashboard aggregates security incidents and alerts from across the Defender product family. It shows active threats and incidents but doesn't provide a view of which Defender for Cloud plans are enabled across subscriptions." |
| 74 | + - content: "You want to protect a specific virtual machine with Defender for Servers Plan 2 without enabling Plan 2 for the entire subscription. Which statement accurately describes this option?" |
| 75 | + choices: |
| 76 | + - content: "Plan 2 can be enabled at the resource level for individual virtual machines in the Azure portal." |
| 77 | + isCorrect: false |
| 78 | + explanation: "Incorrect. Defender for Servers Plan 2 can't be enabled at the resource level. To use Plan 2, you must enable it at the subscription level. You can then disable Plan 2 for specific resources if needed, but you can't enable it only for individual machines." |
| 79 | + - content: "Plan 2 must be enabled at the subscription level; you can then disable it for specific resources to exclude them from protection." |
| 80 | + isCorrect: true |
| 81 | + explanation: "Correct. Defender for Servers Plan 2 is a subscription-level plan and can't be enabled for individual resources. The correct approach is to enable Plan 2 at the subscription level, which protects all qualifying resources, and then use resource-level overrides to disable the plan for specific machines that don't need Plan 2 protection." |
| 82 | + - content: "Plan 2 can be enabled at the resource level using the Azure REST API, even if it can't be enabled through the portal." |
| 83 | + isCorrect: false |
| 84 | + explanation: "Incorrect. Defender for Servers Plan 2 can't be enabled at the resource level through either the portal or the REST API. Only Plan 1 supports resource-level enablement. Plan 2 is a subscription-level plan with the option to disable specific resources." |
| 85 | + - content: "Both Plan 1 and Plan 2 support full enable and disable operations at the individual resource level." |
| 86 | + isCorrect: false |
| 87 | + explanation: "Incorrect. Only Plan 1 supports being fully enabled or disabled at the resource level. Plan 2 can only be disabled at the resource level—it can't be enabled on individual resources. Plan 2 enablement requires a subscription-level configuration." |
0 commit comments