SC-200 Practice Test 12 — 15 Questions

Question 1

A company uses Microsoft Defender for Cloud to manage security across multiple Azure subscriptions. They want to automatically remediate non-compliant resources when a policy violation is detected—for example, enabling encryption on a storage account that has it disabled. Which feature should they configure?

Accepted Answer

Azure Policy's DeployIfNotExists effect. Azure Policy's DeployIfNotExists effect is the correct feature because it automatically deploys a resource configuration (such as enabling encryption on a storage account) when a policy evaluation detects non-compliance. This effect runs during policy evaluation and remediation tasks, ensuring that the resource is brought into compliance without manual intervention. It is specifically designed for automated remediation of non-compliant resources in Azure, aligning with the requirement to fix violations like missing encryption.

Answer

Regulatory compliance dashboard

Answer

Adaptive network hardening

Answer

Just-In-Time VM access

Question 2

In Microsoft 365 Defender, what is the primary function of the Action center?

Accepted Answer

View and manage pending and completed remediation actions from automated investigations.. The Action center in Microsoft 365 Defender is the centralized console for tracking and managing remediation actions generated by automated investigations. It consolidates both pending actions (requiring approval) and completed actions (e.g., quarantining a file, blocking an IP) across Defender for Endpoint, Office 365, Identity, and Cloud Apps, ensuring security teams can review and approve or reject responses without switching contexts.

Answer

Manage user roles and permissions for the security portal.

Answer

Create custom detection rules using advanced hunting queries.

Answer

Manage threat intelligence feeds and indicators.

Question 3

Match each Kusto Query Language (KQL) operator to its function.

Question 4

Match each threat intelligence indicator type to its description.

Question 5

Arrange the steps to deploy Microsoft Defender for Cloud Apps (formerly MCAS) and connect it to a cloud app.

Question 6

A security operations center (SOC) is configuring automated investigation and response (AIR) for Microsoft Defender for Office 365. Which of the following actions can be automatically taken when a malicious email is detected by AIR policies? (Choose all that apply.)

Accepted Answer

Soft delete the email from user mailbox. Option A is correct because AIR policies in Microsoft Defender for Office 365 can automatically soft-delete a malicious email from a user's mailbox. Soft deletion moves the email to the Recoverable Items folder, allowing administrators to restore it if needed, which is a standard remediation action for confirmed threats.

Answer

Add the sender to the user's blocked sender list

Answer

Permanently delete the email from all mailboxes

Question 7

An organization uses Microsoft 365 Defender. A security analyst is investigating a malware incident on a user's device. The automated investigation and response (AIR) has already isolated the device from the network. The analyst now needs to collect a copy of a specific suspicious file from the device for further analysis. Which action should the analyst initiate from the device's entity page?

Accepted Answer

Collect investigation package. Option A is correct because the 'Collect investigation package' action on the device entity page in Microsoft 365 Defender gathers a ZIP file containing the device's forensic data, including specific suspicious files, registry keys, and memory dumps. This is the designed method for retrieving a copy of a file for offline analysis without requiring interactive access, and it works even after AIR has isolated the device.

Answer

Run antivirus scan

Answer

Restrict app execution

Answer

Initiate a live response session

Question 8

A security analyst receives an alert in Microsoft Defender for Cloud about a suspicious process on an Azure VM. The alert indicates a potential credential dumping tool. The analyst needs to see the full command line and parent process of the suspicious process. Which Defender for Cloud feature should the analyst use?

Accepted Answer

Live Response. Live Response in Microsoft Defender for Cloud provides the analyst with the ability to remotely investigate a live Azure VM. It allows the analyst to run commands, collect forensic artifacts, and view detailed process information, including the full command line and parent process of the suspicious process, which is essential for analyzing a potential credential dumping tool.

Answer

Fileless attack detection

Answer

Just-In-Time VM access

Answer

Adaptive application controls

Question 9

A security analyst in Microsoft Defender for Cloud receives an alert that an Azure VM has a vulnerability with a high severity. The analyst wants to see the detailed finding, including the steps to remediate. Which blade or page should the analyst open?

Accepted Answer

Vulnerability Assessment findings. The Vulnerability Assessment findings blade in Microsoft Defender for Cloud displays detailed results from integrated vulnerability scanners (such as Qualys or Microsoft Defender Vulnerability Management), including the specific vulnerability ID, severity, description, and remediation steps. This is the correct location to view the detailed finding and remediation guidance for a high-severity vulnerability on an Azure VM.

Answer

Secure Score

Answer

Regulatory Compliance

Answer

Workload protections alerts

Question 10

A company uses Microsoft Defender for Cloud to protect an Azure Kubernetes Service (AKS) cluster. The security team wants to receive security alerts about suspicious activities within the cluster, such as a container running with root privileges or attempts to read sensitive host paths. Which Defender for Cloud plan must be enabled to generate these alerts?

Accepted Answer

Defender for Containers. Defender for Containers is the specific plan that provides threat detection for Azure Kubernetes Service (AKS) clusters, including alerts for suspicious activities such as containers running with root privileges or attempts to read sensitive host paths. This plan monitors the Kubernetes control plane and container runtime to generate security alerts based on Kubernetes audit logs and container-specific signals.

Answer

Defender for Servers

Answer

Defender for Cloud Apps

Answer

Defender for SQL

Question 11

A company has multiple Azure subscriptions managed by Microsoft Defender for Cloud with enhanced security features enabled. The security team wants to ensure that all Azure SQL Servers have Advanced Data Security (ADS) enabled, including Vulnerability Assessment. They decide to use Azure Policy to enforce this at scale. Which built-in policy initiative should they assign to achieve this?

Accepted Answer

Azure Security Benchmark. The Azure Security Benchmark initiative includes built-in policies to enforce Advanced Data Security (ADS) and Vulnerability Assessment on Azure SQL Servers. Assigning this initiative at scale ensures compliance with security best practices across all subscriptions, as it contains the specific policy effect to enable ADS and VA automatically.

Answer

Enable Azure Monitor for VMs

Answer

Deploy Diagnostics Settings for SQL Databases

Answer

Enable Advanced Threat Protection for SQL servers

Question 12

A security administrator in Microsoft Defender for Cloud notices that the Secure Score is lower than expected. Which action would most effectively improve the Secure Score by reducing the attack surface?

Accepted Answer

Enable Just-in-Time (JIT) VM access for all virtual machines.. Enabling Just-in-Time (JIT) VM access reduces the attack surface by locking down inbound traffic to Azure VMs, allowing only authorized users to open specific ports (e.g., RDP 3389, SSH 22) for a limited time. This directly improves the Secure Score because Microsoft Defender for Cloud includes JIT recommendations as a high-impact security control, and implementing it reduces the number of exposed management ports that attackers can target.

Answer

Configure auditing on all SQL databases.

Answer

Disable all low-severity security alerts in the subscription.

Answer

Install EDR agents on all on-premises servers.

Question 13

A company has Azure virtual machines running Windows Server. The security team wants to use Microsoft Defender for Cloud's vulnerability assessment solution to identify missing security updates. Which of the following is required to enable built-in vulnerability assessment for VMs?

Accepted Answer

Enable Defender for Servers plan. The built-in vulnerability assessment solution in Microsoft Defender for Cloud for Azure VMs is powered by Qualys and is automatically provisioned when the Defender for Servers plan is enabled. This integration does not require manual agent installation or third-party solutions; enabling the plan activates the scanner on supported VMs to identify missing security updates and other vulnerabilities.

Answer

Install the Log Analytics agent manually

Answer

Configure a vulnerability assessment solution from Azure Marketplace

Answer

Enable the regulatory compliance dashboard

Question 14

A Defender for Cloud alert repeatedly fires for a known test VM used by the security team. The alert type is valid, but it should not create noise for that VM. What should the analyst configure?

Accepted Answer

Create an alert suppression rule scoped to the test VM and alert type.. Option A is correct because an alert suppression rule in Microsoft Defender for Cloud allows you to define a scope (e.g., a specific VM) and a condition (e.g., a specific alert type) to automatically dismiss alerts that are valid but not actionable for that resource. This reduces noise without affecting detection coverage for other resources. The rule is configured at the subscription or resource group level and applies only to matching alerts.

Answer

Disable Defender for Servers for the entire subscription.

Answer

Change the VM name.

Answer

Delete the recommendation from secure score.

Question 15

A company wants to enable vulnerability scanning for Azure virtual machines using the integrated Microsoft Defender Vulnerability Management solution. What is the first step?

Accepted Answer

Enable the 'Servers' plan in Defender for Cloud.. The first step to enable vulnerability scanning for Azure VMs using the integrated Microsoft Defender Vulnerability Management solution is to enable the 'Servers' plan in Defender for Cloud. This plan activates the Defender for Cloud integration with Microsoft Defender Vulnerability Management, which automatically discovers and assesses vulnerabilities on supported Azure VMs without requiring any additional agent or extension installation. Once the plan is enabled, vulnerability assessment is performed natively by the Defender for Cloud platform.

Answer

Install the Defender Vulnerability Management extension on each VM.

Answer

Configure a vulnerability assessment solution in the VM's security settings.

Answer

Create a vulnerability assessment rule in Azure Policy.