Q16 RBAC Domain 4 · 20–25% of exam

Which Microsoft Defender for Cloud plan provides runtime threat protection for AKS by analysing Kubernetes audit logs for suspicious activity?

  1. A Defender for Servers
  2. B Defender for Containers (AKS protection) (correct answer)
  3. C Defender for App Service
  4. D Defender for APIs

Shortcut: , privileged container creation, role escalation, crypto mining indicators), and generates security alerts.

Defender for Containers monitors AKS audit logs, detects suspicious API calls (e.g., privileged container creation, role escalation, crypto mining indicators), and generates security alerts.