Prepare for SC-200 with a reference that remembers your progress.

Cloud workload protection applies threat detection tuned to the service being protected. Each Defender plan uses workload-native signals, Microsoft threat intelligence, and behavioral analytics to detect different attack paths.

Coverage can extend to Azure VMs, Azure Arc-enabled servers, and supported multicloud machines.

Defender for App Service provides Azure-native, agentless protection for supported App Service workloads. It analyzes platform and application signals, inbound requests, and management operations to detect web attacks, suspicious access, and post-exploitation behavior.

Defender for Storage protects Azure Blob Storage, Azure Files, and Data Lake Storage against suspicious access, data exfiltration, permission changes, and malicious uploads. Malware reputation based on file hashes is not the same as inspecting file contents; configure current malware-scanning capabilities when content scanning is required.

Defender for SQL combines vulnerability assessment with advanced threat protection for Azure SQL Database, Managed Instance, Synapse SQL, and SQL servers on machines. Detections include SQL injection, anomalous access, brute force, privilege abuse, and suspicious query behavior.

Defender for open-source relational databases monitors supported PostgreSQL, MySQL, and related database services for unusual access, anomalous queries, brute-force attempts, suspicious applications, and potentially compromised credentials.

Defender for Key Vault detects unusual or potentially harmful attempts to access keys, secrets, and certificates. Alerts include context such as user principal, source IP, operation, and object ID. A familiar identity or application does not automatically make anomalous access benign.

Defender for Resource Manager analyzes Azure control-plane operations made through the portal, API, CLI, or automation. It can identify suspicious source IPs, antimalware disabling, malicious VM extensions, tools such as PowerZure or MicroBurst, and lateral movement from control plane to data plane.

Investigate the alert together with the Azure Activity Log, identity sign-in data, affected resource configuration, and any subsequent data-plane actions.

DNS telemetry reveals attempted communication even when payload traffic is encrypted. Defender for DNS identifies tunneling, command-and-control infrastructure, malicious or phishing domains, cryptomining destinations, and suspicious resolvers.

Defender for Containers covers supported AKS, EKS, and Arc-enabled Kubernetes environments. It combines cluster hardening recommendations, image vulnerability assessment, Kubernetes policy, node and control-plane signals, audit logs, and runtime detections.

• Find vulnerable images in registries and identify where they are running.
• Assess cluster configuration and admission-policy compliance.
• Detect suspicious commands, privilege escalation, exposed dashboards, and anomalous API activity.

Additional coverage can include network-layer analytics based on flow data, Defender for Cosmos DB, Web Application Firewall alerts, DDoS Protection alerts, and Defender for Cloud Apps integration. These signals enrich investigations across identity, application, network, and data layers.

Match each workload to its telemetry and detections: server endpoint signals, App Service platform logs, storage operations, database queries, Key Vault object access, ARM control-plane operations, DNS queries, or Kubernetes audit/runtime data.

Select workload plans according to deployed services, risk, and required detection depth. Investigate alerts with the service-native logs and entity context appropriate to that workload.