Knowledge Check

1.

Contoso's cloud security team needs to protect both Azure SQL Managed Instance and Azure Database for MySQL. Which Defender for Databases plan selection correctly covers both services?

Defender for Azure SQL Databases covers both Azure SQL Managed Instance and Azure Database for MySQL in a single plan

Defender for open-source relational databases covers all Azure PaaS database services including Azure SQL

Defender for Azure SQL Databases for SQL Managed Instance, and Defender for open-source relational databases for Azure Database for MySQL

A single Defender for Databases plan covers all Azure relational database services

2.

A security engineer enables Defender for Azure SQL Databases at subscription scope. Which statement correctly describes the resulting coverage behavior?

Only Azure SQL resources created before the enablement date receive protection; new resources require individual enrollment

All existing and future Azure SQL resources in the subscription receive protection automatically

Each Azure SQL server must be individually enrolled in Defender for Cloud after subscription-level enablement

Coverage applies to Azure SQL Database but SQL Managed Instance requires a separate enablement step

3.

A cloud security engineer runs a vulnerability assessment on Contoso's Azure SQL Database and sees several findings. Some findings represent accepted configurations, such as broad read permissions for an internal reporting service account. What is the correct action to prevent these known findings from appearing as open issues?

Create an alert suppression rule in Defender for Cloud scoped to the affected storage account

Disable vulnerability assessment on the affected database to remove the false-positive findings

Set a baseline for the findings to mark the accepted configurations as known and expected

Remove the Defender for Azure SQL Databases plan from the affected SQL server to clear the findings

Check your knowledge

Feedback