A consultant wants every Microsoft Defender for Cloud plan enabled “just in case,” including products outside the January 22, 2026 AZ-500 skill list. Which plans should the Azure security engineer prioritize from the lock-lab workload mix?
Select an answer to reveal the explanation.
Short Explanation
Don’t flip every toggle in the catalog. Match the estate: Servers for the VMs, Databases for the SQL and Postgres boxes, Storage for the blob accounts—and leave the brochure extras on the shelf.
Full Explanation
From the lock-lab workload mix, prioritize Microsoft Defender for Servers, Microsoft Defender for Databases, and Microsoft Defender for Storage—the named cloud workload protection plans that match virtual machines, database engines, and storage accounts the estate actually runs. AZ-500 expects engineers to enable plans aligned to real workloads rather than every catalog toggle.
Enabling only Microsoft Defender for Cloud Apps and Microsoft Defender XDR while skipping Servers and Storage leaves the core IaaS and data-plane threat plans off for the lab. Relying only on Security Copilot posture agents pretends assistants replace named Defender for Cloud plans. Enabling every preview plan regardless of matching workloads wastes budget and dilutes operational focus without improving coverage for workloads that are not present.
Exam caveat: the January 22, 2026 AZ-500 skill list emphasizes matching plans to workloads; products outside that list may exist in the portal but are not the exam’s first-class Domain 4 answers for this scenario.
Operational check: inventory lock-lab VMs, databases, and storage accounts; in Defender for Cloud plans, enable Servers, Databases, and Storage for those workloads; leave unrelated preview plans disabled unless a documented civic requirement demands them.