Your Azure VMs run Windows Server. You need to ensure that only approved applications can run on these VMs and any unknown executables are blocked. Which Defender for Cloud feature provides this application control?

Direct Answer (Verified)Reviewed by Sunny (Senior Cloud Engineer)

Correct Answer: Enable Adaptive Application Controls in Defender for Cloud to create and enforce application allowlists

Adaptive Application Controls in Microsoft Defender for Cloud uses machine learning to analyze the processes running on your VMs and suggests allowlist rules. When enforced, it use...

📋Part of Microsoft Certified: Azure Security Engineer Associate (AZ-500) · Azure Certification Practice
Real Exam ScenarioVM Security

Your Azure VMs run Windows Server. You need to ensure that only approved applications can run on these VMs and any unknown executables are blocked. Which Defender for Cloud feature provides this application control?

✓ Correct Answer & ExplanationVM Security

Correct Answer

Enable Adaptive Application Controls in Defender for Cloud to create and enforce application allowlists

Why This Answer Is Correct

Adaptive Application Controls in Microsoft Defender for Cloud uses machine learning to analyze the processes running on your VMs and suggests allowlist rules. When enforced, it uses Windows AppLocker (or Linux equivalent) to block unauthorized executables. FIM monitors file changes but does not block application execution.

📚 What This Question Tests

This question evaluates your knowledge of VM Security — a core concept tested in Microsoft Certified: Azure Security Engineer Associate (AZ-500). Understanding VM Security is essential for designing scalable, secure, and cost-effective cloud architectures. Mastery of this topic will help you answer scenario-based questions confidently on exam day.

All Microsoft Certified: Azure Security Engineer Associate (AZ-500) Questions →Browse All Azure Exams →

More VM Security Practice Questions

A security audit reveals that Azure VMs in your environment have public IP addresses with RDP port 3389 open to the internet in their NSGs. You need to provide emergency access for administrators while eliminating the persistent exposure. What is the recommended solution?

← Back to Microsoft Certified: Azure Security Engineer Associate (AZ-500) Full Practice Hub