Microsoft Security Operations Analyst Associate SC-200 Practice Question

File integrity monitoring (FIM) in Microsoft Defender for Cloud watches operating-system and application files for unexpected changes and raises security alerts when modifications are detected. FIM is provided only by Microsoft Defender for Servers Plan 2, which automatically deploys the Microsoft Defender for Endpoint (MDE) agent and enables advanced threat protections, including FIM, across both Windows and Linux virtual machines. Defender for Servers Plan 1 offers baseline hardening, antimalware, and vulnerability assessment but does not include FIM. Microsoft Defender for Endpoint Plan 1 licensing alone does not activate Defender for Cloud's FIM feature, and the Cloud Security Posture Management (CSPM) plan focuses on configuration hardening rather than real-time workload protections such as FIM. Therefore, enabling Microsoft Defender for Servers Plan 2 is required.