Which Defender for Cloud Plan Protects Applications on AKS1?

Manage security posture by using Defender for Cloud Implement security for application platform services

Answer Correct answer: C — Enable Microsoft Defender for Containers to protect the AKS1 cluster and its hosted applications.

Overview Contoso, Ltd. is a consulting company that has a main office in San Francisco and a branch office in Dallas. Contoso has a hybrid environment that contains on-premises servers connected to Azure, a Microsoft 365 E5 subscription, and an Azure subscription named Sub1. Existing Environment. Microsoft Entra tenant Contoso has a Microsoft Entra tenant named contoso.com that contains the users shown in the following table. exhibit Existing Environment. On-premises environment The on-premises network contains an Active Directory Domain Services (AD DS) forest that syncs with contoso.com. The forest contains a server named Server1 that runs Windows Server. Existing Environment. Azure subscription Sub1 contains the storage accounts shown in the following table. exhibit Sub1 contains the virtual networks shown in the following table. exhibit Sub1 contains the virtual machines shown in the following table. exhibit The network interface of VM1 is associated with an application security group named ASG1. Sub1 contains the resources shown in the following table. exhibit Vault1 stores the objects shown in the following table. exhibit Existing Environment. Privileged Identity Management (PIM) configuration You manage privileged roles by using Privileged Identity Management (PIM). The PIM role settings are configured as shown in the following table. exhibit Existing Environment. Microsoft Sentinel configuration Contoso has a Microsoft Sentinel workspace that contains the following tables. exhibit Requirements. Planned changes Contoso plans to implement the following changes: Integrate AKS1 with Vault1. Enable Microsoft Entra Kerberos authentication for all supported storage. Configure auditing for sql1 by using the Azure portal and store audit logs in a centralized location. Requirements. Technical requirements Contoso identifies the following technical requirements: Protect Server1 by using file integrity monitoring. Protect AKS1 by using Microsoft Defender for Cloud. Configure Microsoft Sentinel to retain data for the maximum supported duration without changing the tier. Store objects used for authentication and encryption in Vault1 and ensure that Vault1 regenerates the objects every 30 days, whenever possible. You need to protect the applications hosted on AKS1. The solution must meet the technical requirements. Which Defender for Cloud plan should you enable?

Microsoft Defender for Servers
Microsoft Defender for App Service
Microsoft Defender for Containers Correct Answer
Microsoft Defender for Resource Manager
Microsoft Defender for Storage

Community Insight

The question tests mapping an AKS workload to the correct Defender for Cloud plan; the trap is selecting Defender for App Service merely because AKS hosts applications.

Protecting applications hosted on Azure Kubernetes Service requires enabling the Microsoft Defender for Containers plan in Defender for Cloud, because it provides Kubernetes-aware threat detection and posture controls for clusters such as AKS1. The page confirms Defender for Containers as the correct SC-500 answer and explains why App Service, Servers, Resource Manager, and Storage plans do not cover AKS workloads.

Learners often pick Microsoft Defender for App Service because the requirement mentions applications hosted on AKS1, but App Service protection covers Azure App Service PaaS workloads, not Kubernetes clusters.

Community Discussion (1 comments)

Craigg 👍 1 Selected: C

Defender for App Service is strictly built to monitor the Azure App Service PaaS platform (such as Web Apps and API Apps). It looks at web transaction logs, App Service file systems, and specific PaaS-level threats. It has no visibility into Kubernetes architecture.Defender for Containers is purpose-built for Kubernetes. It understands cluster components like the API server, control plane, node operating systems, namespaces, and pods.

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Expert Analysis

Why the Answer Is Correct

Microsoft Defender for Containers is the Defender for Cloud plan designed for Kubernetes workloads, including Azure Kubernetes Service clusters such as AKS1. Enabling it at the subscription or cluster scope gives Contoso Kubernetes-aware posture assessment, control-plane audit log analysis, runtime threat detection, and vulnerability assessment for container images and nodes. That directly satisfies the requirement to protect AKS1 by using Microsoft Defender for Cloud and extends protection to the applications hosted on the cluster. The plan is not selected because AKS is an application platform in the broad sense; it is selected because Defender for Containers is the only listed plan that understands Kubernetes architecture and container runtime activity.

Why the Other Options Are Wrong

Microsoft Defender for Servers protects Windows and Linux virtual machines, including server workload threat detection and file integrity monitoring, but it does not provide AKS control-plane or container-specific coverage. Microsoft Defender for App Service monitors Azure App Service web apps and API apps, so it cannot see Kubernetes API server events, node behavior, or container image risks. Microsoft Defender for Resource Manager focuses on Azure Resource Manager control-plane operations and subscription-level management activity, not workloads running inside AKS1. Microsoft Defender for Storage protects Azure Storage accounts and their data-plane threats, which is unrelated to protecting applications hosted on AKS1.

Community Comment Notes

As Craigg noted, Defender for App Service is built for the Azure App Service PaaS platform and "has no visibility into Kubernetes architecture," which makes it unsuitable for AKS1. The same comment explains that Defender for Containers is "purpose-built for Kubernetes" and understands cluster components such as the API server, control plane, and nodes. That reasoning aligns with the exam requirement to protect AKS1 and its hosted applications using Defender for Cloud.

Official Reference

https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-containers-introduction

Exam Strategy

When a question names AKS, Kubernetes, containers, or container registries, map the requirement to Microsoft Defender for Containers before considering App Service or Servers plans. Read the protected resource, not just the word “application,” because AKS-hosted apps are protected through the cluster plan.

Frequently Asked Questions

Why is Microsoft Defender for App Service not the right plan for AKS1?

App Service protection monitors Azure App Service web apps and API apps; it has no Kubernetes control-plane or node visibility, so it cannot protect AKS1.

Does Defender for Containers protect only the AKS control plane?

No. It also covers node and workload runtime threats, vulnerability assessment, container registry images, and Kubernetes posture recommendations.

More SC-500 FAQ →

Related Analysis

Practice All SC-500 Questions

Access 100 questions with complete answers and detailed explanations.

View Full SC-500 Practice Test →

← Back to SC-500 Study Guide