SC-200 Mitigate threats using Microsoft Defender for Cloud Practice Test 3 — 15 Questions

Question 1

A company uses Microsoft Defender for Cloud to manage security posture. The compliance team needs to continuously monitor resources against the CIS Microsoft Azure Foundations Benchmark and receive a consolidated score across all subscriptions. Which Defender for Cloud feature should they use?

Accepted Answer

Regulatory compliance dashboard. The Regulatory compliance dashboard in Microsoft Defender for Cloud provides continuous monitoring of resources against specific compliance standards, such as the CIS Microsoft Azure Foundations Benchmark, and aggregates a consolidated score across all subscriptions. This feature maps Azure Policy initiatives to compliance controls, showing pass/fail status and a compliance score, which directly meets the compliance team's requirement for ongoing assessment and a unified score.

Answer

Secure Score

Answer

Adaptive application controls

Answer

File Integrity Monitoring (FIM)

Question 2

A security analyst in Microsoft Defender for Cloud is reviewing the Security Alerts for an Azure subscription. The analyst sees an alert titled "Suspicious PowerShell activity detected" on an Azure VM. The analyst needs to view the full command line of the suspicious script and the parent process that launched it. Where in the alert details can the analyst find this information?

Accepted Answer

The "Investigate" tab (with timeline and entities). The 'Investigate' tab in Microsoft Defender for Cloud provides a detailed timeline and entity graph that includes the full command line of the suspicious script and the parent process that launched it. This tab is specifically designed for deep forensic analysis, allowing analysts to trace process ancestry and view raw command-line arguments, which are not available in the general alert description or the Attack story tab.

Answer

The "Attack story" tab

Answer

The "Alert details" pane (general description)

Answer

The "Take action" tab (recommendations)

Question 3

A global organization has Azure subscriptions organized under a single management group. The security team wants to ensure that the Azure Security Benchmark initiative is assigned once to cover all current and future subscriptions within that management group, without needing to assign it individually. They also want to see compliance results aggregated at the management group level. In Microsoft Defender for Cloud, what is the correct approach to achieve this?

Accepted Answer

Assign the Azure Security Benchmark initiative directly to the management group via Azure Policy, and use the Defender for Cloud's Regulatory Compliance dashboard.. Assigning the Azure Security Benchmark initiative directly to the management group via Azure Policy ensures that the policy initiative is inherited by all current and future subscriptions under that management group. Defender for Cloud's Regulatory Compliance dashboard then aggregates compliance results at the management group level, providing a single view of compliance across the entire hierarchy without requiring individual assignments.

Answer

Enable Defender for Cloud's enhanced security features on each subscription, and the benchmark will be automatically applied.

Answer

Create a custom assessment in Defender for Cloud that queries the management group scope.

Answer

Assign the initiative to the root management group using Azure Policy, then configure Defender for Cloud to ignore individual subscription assignments.

Question 4

A company uses Microsoft Defender for Cloud to protect their Azure resources. They have enabled the enhanced security features on a subscription that contains several Azure SQL databases. They want to be alerted if a user attempts to perform SQL injection attacks against these databases. Which Defender for Cloud plan specifically enables SQL injection detection alerts?

Accepted Answer

Defender for SQL. Defender for SQL is the specific Microsoft Defender for Cloud plan that provides SQL-specific threat detection, including alerts for SQL injection attacks. This plan monitors SQL databases for anomalous activities such as SQL injection attempts, brute-force attacks, and unusual access patterns by analyzing query logs and audit records. Enabling Defender for SQL on the subscription activates these detection capabilities for Azure SQL databases, making it the correct choice for the scenario.

Answer

Defender for Servers

Answer

Defender for App Service

Answer

Defender for Storage

Question 5

An organization uses Microsoft Defender for Cloud and needs to track compliance with internal security policies that are not covered by any built-in regulatory standard. They want to see the compliance status for these internal controls in the Regulatory Compliance dashboard alongside other standards. What should they configure?

Accepted Answer

Create a custom Azure Policy initiative with the required controls and assign it to the relevant scopes.. To track compliance with internal security policies not covered by built-in regulatory standards, you must create a custom Azure Policy initiative that defines the required controls and assign it to the relevant scopes. Defender for Cloud automatically evaluates resources against assigned initiatives and surfaces the compliance status in the Regulatory Compliance dashboard alongside built-in standards, allowing unified visibility.

Answer

Create a custom assessment in the Microsoft Defender for Cloud recommendations dashboard.

Answer

Use the Secure Score API to develop a custom dashboard outside Defender for Cloud.

Answer

Enable the "Custom compliance" feature in Defender for Cloud's pricing tier.

Question 6

A security team needs to enforce that all Azure virtual machines have a specific custom script execution baseline (e.g., block PowerShell from executing scripts from the internet). They want to use Microsoft Defender for Cloud to continuously monitor and alert when a VM deviates from this baseline. Which feature should they use?

Accepted Answer

Adaptive application controls. Adaptive application controls (AAC) in Microsoft Defender for Cloud allow you to define allowlists for applications and scripts that can run on your Azure VMs. By configuring AAC to block PowerShell scripts from the internet, the service uses machine learning to establish a baseline of allowed executables and scripts, then continuously monitors for deviations—such as an unauthorized PowerShell script execution—and generates security alerts. This directly meets the requirement for continuous monitoring and alerting on custom script execution baselines.

Answer

Just-In-Time VM Access (JIT)

Answer

Regulatory compliance dashboard

Answer

File Integrity Monitoring (FIM)

Question 7

An organization uses Microsoft Defender for Cloud and has enabled enhanced security features. They want to receive alerts when a user attempts to connect to an Azure VM via RDP from a public IP address that is not in a predefined list of trusted IP ranges. Which Defender for Cloud plan or feature provides this capability?

Accepted Answer

Just-In-Time (JIT) VM access. Just-In-Time (JIT) VM access in Microsoft Defender for Cloud allows you to lock down inbound traffic to Azure VMs, reducing exposure to attacks while providing easy access when needed. When enabled, JIT creates rules in the network security group (NSG) that permit RDP (TCP 3389) or SSH (TCP 22) traffic only from specific IP addresses or ranges that you define, and only during a requested time window. If a user attempts an RDP connection from a public IP not in the trusted list, Defender for Cloud generates an alert, as the traffic is blocked by the JIT policy.

Answer

Adaptive network hardening

Answer

Network security groups (NSG) flow logs

Answer

File Integrity Monitoring (FIM)

Question 8

A company has multiple Azure subscriptions under a management group. They want to ensure that all VMs across all subscriptions have Microsoft Defender for Cloud's vulnerability assessment solution (using the Microsoft Defender Vulnerability Management engine) enabled. They also want to automatically remediate any non-compliant VMs by enabling the VA solution when a VM is missing it. Which combination of policy initiatives and automation should they use?

Accepted Answer

Assign the 'Configure machines to receive a vulnerability assessment provider' policy with 'DeployIfNotExists' effect and set it to auto-remediate at the management group-level scope.. Option D is correct because the 'Configure machines to receive a vulnerability assessment provider' policy with the 'DeployIfNotExists' effect directly deploys the Microsoft Defender Vulnerability Management (MDVM) extension to any VM that lacks it. By assigning this policy at the management group scope and enabling automatic remediation, the policy will automatically remediate non-compliant VMs without requiring additional runbooks or scripts, fulfilling both the detection and automatic remediation requirements.

Answer

Assign the 'Azure Security Benchmark' initiative at the management group, enable automatic remediation for the 'Vulnerability assessment should be enabled on your virtual machines' policy.

Answer

Assign the 'Defender for Cloud' initiative with the 'Configure machines to receive a vulnerability assessment provider' policy, and configure a remediation task with a deployment script.

Answer

Assign the 'Azure Security Benchmark' initiative and create an Azure Automation runbook triggered by a compliance alert to enable VA.

Question 9

A security engineer is configuring Microsoft Defender for Cloud in a hybrid environment that includes on-premises servers connected via Azure Arc. The engineer wants to enable the Defender for Cloud plans for servers (including vulnerability assessment) on all Azure Arc-enabled machines. What is the correct method to deploy the Log Analytics agent (or Azure Monitor Agent) and the Microsoft Defender for Endpoint (MDE) integration?

Accepted Answer

Enable Azure Policy 'Configure Azure Arc machines to run Azure Monitor Agent' with a DeployIfNotExists policy that also installs the MDE extension.. Option B is correct because it leverages Azure Policy with a DeployIfNotExists effect to automatically deploy the Azure Monitor Agent (AMA) and the Microsoft Defender for Endpoint (MDE) extension on Azure Arc-enabled servers. This ensures compliance at scale without manual intervention, and it is the recommended method in Defender for Cloud for hybrid machines. The policy also handles the vulnerability assessment integration by enabling the Defender for Cloud plans for servers.

Answer

Manually install the agents on each server via Group Policy.

Answer

Use the Azure Automation Update Management to deploy agents.

Answer

Enable the 'Log Analytics agent for Windows' extension on each Arc machine via Azure Arc management.

Question 10

A security engineer is configuring Microsoft Defender for Cloud in a hybrid environment with on-premises servers connected via Azure Arc. The engineer wants to enable the Defender for Cloud plans for servers (including vulnerability assessment) on all Azure Arc-enabled machines. What is the correct method to deploy the Log Analytics agent (or Azure Monitor Agent) and the Microsoft Defender for Endpoint (MDE) integration?

Accepted Answer

Use the Defender for Cloud auto-provisioning feature with the Azure Policy 'Deploy Log Analytics agent' and enable MDE integration. Option B is correct because Defender for Cloud's auto-provisioning feature uses built-in Azure Policy initiatives to automatically deploy the Log Analytics agent (or Azure Monitor Agent) to Azure Arc-enabled machines, and it also enables the Microsoft Defender for Endpoint (MDE) integration via the 'Configure machines to receive a vulnerability assessment provider' policy. This ensures consistent, scalable deployment without manual intervention, aligning with the hybrid environment's requirements.

Answer

Manually install the Log Analytics agent on each machine and then enable MDE integration

Answer

Use Azure Arc extensions to install the agents and then configure Defender for Cloud plans

Answer

Deploy the agents via Configuration Manager

Question 11

A security administrator wants to assess their Azure environment against the Azure Security Benchmark and also include custom security controls defined by their organization. They need a single, reusable policy initiative that can be assigned across multiple subscriptions and management groups. What should the administrator create in Microsoft Defender for Cloud?

Accepted Answer

A custom Azure Policy initiative. The administrator needs a single, reusable policy initiative that includes both Azure Security Benchmark controls and custom organizational controls. A custom Azure Policy initiative (also known as a policy set) allows combining multiple policy definitions, including built-in benchmark controls and custom definitions, into one assignable package across subscriptions and management groups. This is the correct approach because initiatives are designed for grouping related policies and can be assigned at scale in Microsoft Defender for Cloud.

Answer

A new regulatory compliance standard

Answer

A custom Azure Policy definition

Answer

A Secure Score recommendation override

Question 12

A security administrator needs to ensure that only approved applications can run on a set of Windows Server virtual machines. The administrator has already enabled Microsoft Defender for Cloud's enhanced security features. Which Defender for Cloud feature should the administrator configure to define a list of allowed applications and get alerts when unapproved applications are executed?

Accepted Answer

Adaptive Application Controls. Adaptive Application Controls (AAC) is the correct feature because it uses machine learning to establish a baseline of known-safe processes on your Windows Server VMs, then enforces an allowlist so that only those approved applications can run. When an unapproved application is executed, AAC generates a security alert in Microsoft Defender for Cloud, meeting the requirement to both define allowed applications and receive alerts on violations.

Answer

File Integrity Monitoring (FIM)

Answer

Just-in-Time VM Access (JIT)

Answer

Vulnerability Assessment

Question 13

A security engineer needs to ensure that all Azure subscriptions under a management group are continuously assessed against the Azure Security Benchmark. They want to see the aggregated compliance score at the management group level. What should the engineer do in Microsoft Defender for Cloud?

Accepted Answer

Assign the Azure Security Benchmark initiative to the management group.. Assigning the Azure Security Benchmark initiative to the management group ensures that all subscriptions under that management group are continuously assessed against the benchmark. The aggregated compliance score is then visible at the management group level in the Regulatory Compliance dashboard, providing a single view of compliance across the entire hierarchy.

Answer

Assign the Azure Security Benchmark initiative to each subscription individually and use the secure score dashboard.

Answer

Enable the Regulatory Compliance dashboard and select the Azure Security Benchmark from the built-in standards list.

Answer

Configure Secure Score policies at the management group and enable Azure Security Benchmark.

Question 14

A security administrator wants to enforce Just-in-Time (JIT) VM access for all Azure virtual machines in a management group to reduce the attack surface. The administrator wants to automatically enable JIT on any new VM and remediate existing non-compliant VMs. What should the administrator configure in Microsoft Defender for Cloud?

Accepted Answer

Assign the built-in policy initiative 'Configure just-in-time network access on virtual machines' at the management group level.. The built-in policy initiative 'Configure just-in-time network access on virtual machines' can be assigned at the management group scope to automatically enable JIT on new VMs and remediate existing non-compliant VMs via a DeployIfNotExists effect. This ensures consistent enforcement across all subscriptions under that management group without manual per-subscription configuration.

Answer

Manually enable JIT in Defender for Cloud's 'Just-in-time VM access' blade for each subscription.

Answer

Configure Azure Policy Guest Configuration to require JIT on virtual machines.

Answer

Create a custom Azure Policy definition to enforce JIT and assign it to each subscription.

Question 15

A security team wants to enable advanced threat detection for all Azure SQL databases across multiple subscriptions. They want to receive alerts for SQL injection attempts and anomalous activities. Which action should they take in Microsoft Defender for Cloud?

Accepted Answer

Enable the Microsoft Defender for SQL plan at the subscription level.. Microsoft Defender for SQL provides advanced threat detection for Azure SQL databases, including alerts for SQL injection attempts and anomalous activities. Enabling the plan at the subscription level automatically protects all existing and future SQL databases within that subscription, ensuring centralized management and compliance.

Answer

Enable the Microsoft Defender for Servers plan on each subscription.

Answer

Configure SQL Auditing and Threat Detection on each SQL server individually.

Answer

Create an Azure Policy to deploy Azure SQL Firewall rules.