Azure Defender for Servers Adaptive Application Controls Support

AZ-500 By islever Editorial Last updated

Configure and manage threat protection by using Microsoft Defender for Cloud

Short answer

A Only VM1 and VM2 support adaptive application controls because VM3 lacks a GUI and VM4 has a conflicting AppLocker policy.

Question

You have an Azure subscription that contains the virtual machines shown in the following table. You are configuring Microsoft Defender for Servers. You plan to enable adaptive application controls to create an allowlist of known-safe apps on the virtual machines. Which virtual machines support the use of adaptive application controls? - Exhibit: Azure Defender for Servers Adaptive Application Controls Support
  1. VM1 and VM2 only Correct Answer
  2. VM2 and VM4 only
  3. VM2 and VM3 only
  4. VM1, VM2, VM3, and VM4

Key Takeaways

The core trap involves assuming all server editions support advanced Defender features, ignoring that Server Core lacks a GUI and AppLocker conflicts with application allowlisting.

This question tests the compatibility of Microsoft Defender for Servers' adaptive application controls with various Windows Server configurations. The correct answer is (A) because Server Core and AppLocker are incompatible with this specific feature.

Common mistake: Most learners choose (D), incorrectly believing that all listed virtual machines support adaptive application controls due to a misunderstanding of OS limitations and policy conflicts.

Expert Analysis

Why the Answer Is Correct

Adaptive Application Controls in Microsoft Defender for Servers rely on analyzing process execution data to create allowlists. This feature requires a graphical user interface (GUI) to function effectively and display the recommended actions. VM1 (Windows Server 2019 Datacenter with GUI) and VM2 (Windows Server 2016 Standard with GUI) both meet these requirements. Therefore, they are the only supported options among the choices provided.

Why the Other Options Are Wrong

VM3 runs Windows Server 2019 Datacenter Server Core. Since Server Core installations do not have a GUI, they cannot support Adaptive Application Controls, which need the UI to present the allowlist recommendations. VM4 has an AppLocker policy enabled. AppLocker and Adaptive Application Controls serve similar purposes (application whitelisting) and can conflict with each other; thus, VM4 is excluded from support when AppLocker is active.

Community Comment Notes

The community is divided, with many votes favoring option D based on the assumption that 'all OS can be protected.' However, detailed comments correctly identify that 'Server Core installations are not supported' and 'Machines using AppLocker are incompatible.' One commenter noted that AppLocker 'may conflict,' while another explicitly stated the GUI requirement, leading to the conclusion that only VM1 and VM2 are valid.

Exam Strategy

When studying Defender for Servers, memorize the specific exclusions for its features. Always check if the target VM has a GUI and if conflicting security tools like AppLocker are enabled before selecting 'All of the above'.

Frequently Asked Questions

Why doesn't Server Core support Adaptive Application Controls?

Server Core lacks a Graphical User Interface (GUI), which is required for the feature to present allowlist recommendations and manage settings.

Can AppLocker and Defender Application Control work together?

No, they are incompatible. If AppLocker is enabled, Defender for Servers disables Adaptive Application Controls to prevent policy conflicts.

More AZ-500 FAQ →

Community Votes

D
75%
A
25%

75% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 4 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 4

  1. ezmoney 👍 6
    Answer = A (VM1 and VM2 only) -Adaptive application controls help in defining an allowlist of known-safe applications for virtual machines. -Windows Server Core installations, like VM3, are not supported by this feature. -VM4 is configured with an AppLocker policy, which may conflict with adaptive application controls as they perform similar functions for application whitelisting. Thus, the answer will focus on the virtual machines that are neither Server Core nor use AppLocker. That would be VM1 (Windows Server 2019) and VM2 (Windows Server 2022). The correct answer is A. VM1 and VM2 only.
  2. Hot_156 👍 2 Answered D
    The answer is D All the OS can be protected with Defender for servers. VM1 - Yes VM2 - Yes VM3 - Yes - Server core is a minimal installation, but it still supports adaptive application controls VM3 - Yes - Applocker policy can work in conjunction with Defender for servers.
  3. moadabdou 👍 1 Answered A
    VM1 and VM2 only. Microsoft Defender for Servers enables Adaptive Application Controls, which help create an allowlist of known and trusted applications on virtual machines. However, there are some restrictions: Machines must have a graphical user interface (GUI) – Server Core installations are not supported. Machines using AppLocker are incompatible – Virtual machines with an AppLocker policy configured cannot use Adaptive Application Controls.
  4. karampa 👍 1 Answered D
    AAC and Applocker can work in conjunction

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Entra Permissions Management Highly Privileged Roles

S-grade

Restricting AKS API server access to specific networks is done with authorized IP address ranges

S-grade

Cross-tenant access settings for B2B collaboration apply only to Microsoft Entra ID tenants, not to Google or Microsoft accounts

S-grade

Creating an allow list of a partner's cloud apps for your users is configured via Outbound access settings in Cross-tenant access settings

S-grade

← Back to AZ-500 Study Guide