Contoso runs a customer-facing API on Azure App Service, a set of Azure Functions (Consumption plan) that process order events, and an Azure SQL Database. The security architect wants continuous vulnerability assessment, threat detection for anomalous data-plane activity on the database, and runtime alerts for the serverless compute — all surfaced in Microsoft Defender for Cloud. Which combination of Defender plans should be enabled to meet these requirements with the least configuration overhead?