SC-200 Mitigate threats using Microsoft Defender for Cloud Practice Test 4 — 15 Questions

Question 1

A security engineer is responsible for protecting containerized workloads in Azure Kubernetes Service (AKS) clusters. They want to enable Microsoft Defender for Cloud to detect threats against the Kubernetes control plane and container runtime. Additionally, they want to ensure vulnerability assessments are performed on images stored in Azure Container Registry. Which Defender for Cloud plan should the engineer enable?

Accepted Answer

Enable the Microsoft Defender for Containers plan on the subscription.. Option B is correct because the Microsoft Defender for Containers plan is the only plan that provides integrated threat detection for the AKS control plane and container runtime, as well as vulnerability assessment for images in Azure Container Registry. This plan replaces the legacy Defender for Container Registries and Defender for Kubernetes plans, offering a unified solution for container security.

Answer

Enable the Microsoft Defender for Servers plan on the subscription.

Answer

Enable the Microsoft Defender for App Service plan on the subscription.

Answer

Enable the Microsoft Defender for Container Registries plan (legacy) on the registry.

Question 2

A security administrator wants to see the overall security posture of all their Azure subscriptions in a single numerical score. Which dashboard in Microsoft Defender for Cloud provides this score based on implemented security controls?

Accepted Answer

Secure Score. The Secure Score dashboard in Microsoft Defender for Cloud aggregates the security posture across all Azure subscriptions into a single numerical score. This score is calculated based on the implementation of security controls and recommendations, reflecting the percentage of completed security measures. The administrator needs this consolidated view, which is exactly what Secure Score provides.

Answer

Regulatory Compliance

Answer

Inventory

Answer

Recommendations

Question 3

A company has enabled Microsoft Defender for Cloud on their subscription containing Azure SQL databases. They receive an alert about a potential SQL injection attack. The analyst wants to see the actual query that was executed. Where can the analyst find the query details associated with the alert?

Accepted Answer

In the alert's entity tab. Option A is correct because when Microsoft Defender for Cloud detects a SQL injection attack, the alert details include an 'Entities' tab that contains the actual SQL query that was executed. This tab provides the raw query text, which is essential for the analyst to understand the exact payload used in the attack and to assess the impact on the database.

Answer

By opening the SQL database's threat detection logs

Answer

In the Azure Activity Log

Answer

In the alert's diagnostic data

Question 4

A company wants to enable Microsoft Defender for Cloud's enhanced security features for all Azure virtual machines in a subscription. What is the first action they should take in the Defender for Cloud pricing & settings page?

Accepted Answer

Turn on the 'Servers' plan for the subscription. To enable Microsoft Defender for Cloud's enhanced security features for Azure VMs, the first step is to turn on the 'Servers' plan at the subscription level in the Defender for Cloud pricing & settings page. This activates Defender for Servers, which provides threat detection, vulnerability assessment, and just-in-time access. Without enabling this plan, no enhanced security features are available, regardless of other configurations.

Answer

Install the Log Analytics agent on each VM

Answer

Enable vulnerability assessment

Answer

Assign a regulatory compliance policy

Question 5

An organization wants to enable vulnerability assessment for all Azure virtual machines, including future ones, using the integrated Qualys or Microsoft Defender Vulnerability Management solution. What is the recommended approach in Microsoft Defender for Cloud?

Accepted Answer

Enable the Defender for Servers plan and configure auto-provisioning of the vulnerability assessment solution.. The recommended approach is to enable the Defender for Servers plan, which automatically provisions the integrated vulnerability assessment solution (Qualys or Microsoft Defender Vulnerability Management) on all existing and future Azure VMs. This ensures continuous scanning without manual intervention, leveraging auto-provisioning to deploy the necessary extension.

Answer

Manually install the Log Analytics agent and then configure vulnerability assessment on each VM.

Answer

Use Azure Policy to assign the built-in initiative that deploys the vulnerability assessment solution and associates it with VMs.

Answer

Enable Azure Security Center's free tier and manually download the vulnerability assessment tool.

Question 6

Which of the following resource types are supported by Microsoft Defender for Cloud's workload protection plans? (Select all that apply.) (Choose 3.)

Accepted Answer

Azure virtual machines. Microsoft Defender for Cloud's workload protection plans support Azure virtual machines by providing integrated threat detection and advanced security features like just-in-time VM access, file integrity monitoring, and vulnerability assessments. These capabilities leverage the Microsoft Monitoring Agent or Azure Monitor Agent to analyze security events and detect suspicious activities within the VM's operating system and network traffic.

Answer

Azure Logic Apps

Question 7

In Microsoft Defender for Cloud, what does the Secure Score represent?

Accepted Answer

The overall security posture of your resources, based on implemented security controls and recommendations.. The Secure Score in Microsoft Defender for Cloud is a numeric representation of your overall security posture, calculated based on the implementation of security controls and the remediation of recommendations. It aggregates the status of all assessed resources against security best practices, providing a single score that reflects how well you are protecting your workloads. This score helps prioritize actions to improve security, as each recommendation contributes a specific number of points toward the total possible score.

Answer

The number of currently active security alerts.

Answer

The percentage of compliance with the Azure Security Benchmark.

Answer

The number of VMs that have been assessed for vulnerabilities.

Question 8

A security administrator wants to view the overall security posture of all Azure subscriptions in a single numerical score. Which dashboard in Microsoft Defender for Cloud provides this score based on implemented security controls?

Accepted Answer

Secure Score dashboard. The Secure Score dashboard in Microsoft Defender for Cloud aggregates the security posture across all Azure subscriptions into a single numerical score. This score is calculated based on the implementation of security controls and recommendations, providing a quantifiable measure of your overall security hygiene.

Answer

Regulatory compliance dashboard

Answer

Inventory dashboard

Answer

Recommendations dashboard

Question 9

An organization needs to meet PCI DSS compliance requirements and also enforce a custom policy requiring that encryption keys be stored in a specific Azure Key Vault. The security administrator wants to view a unified compliance score that includes both the built-in PCI DSS standard and the custom policy. What should the administrator do in Microsoft Defender for Cloud?

Accepted Answer

Create a custom initiative that includes the PCI DSS built-in policy set and the custom key vault policy, then assign it to the scope. Option B is correct because Microsoft Defender for Cloud's regulatory compliance dashboard can only display a unified compliance score when all relevant standards and custom policies are grouped into a single initiative. By creating a custom initiative that includes both the built-in PCI DSS policy set and the custom Key Vault policy, then assigning that initiative to the scope, the administrator ensures the compliance score reflects both requirements in one view.

Answer

Assign the built-in PCI DSS regulatory compliance standard and add a custom policy through Azure Policy

Answer

Use Azure Blueprints to deploy the PCI DSS standard and custom policies

Answer

Enable the Secure Score dashboard to measure compliance

Question 10

A security administrator wants to enable vulnerability assessment for all existing and future Azure virtual machines in a subscription using the integrated Microsoft Defender Vulnerability Management solution. What is the recommended action in Microsoft Defender for Cloud?

Accepted Answer

Enable the 'Vulnerability assessment for machines' component in the Defender for Servers plan settings within the subscription's pricing & settings page.. Option A is correct because enabling the 'Vulnerability assessment for machines' component in the Defender for Servers plan settings within the subscription's pricing & settings page automatically provisions the integrated Microsoft Defender Vulnerability Management (MDVM) solution to all existing and future Azure VMs without manual agent installation. This is the recommended and native method in Microsoft Defender for Cloud to enable vulnerability assessment at scale, leveraging the built-in Qualys or MDVM scanner that is managed by the platform.

Answer

Manually install the Microsoft Defender Vulnerability Management agent on each VM via an Azure Policy initiative.

Answer

Create an Azure Policy that assigns the 'Configure machines to receive a vulnerability assessment provider' built-in policy to the subscription.

Answer

Enable 'Vulnerability assessment for machines' in the Azure Security Benchmark compliance dashboard.

Question 11

A security administrator in Microsoft Defender for Cloud notices that the Secure Score is lower than expected. Which action would most effectively improve the Secure Score by reducing the attack surface?

Accepted Answer

Enable Just-in-Time (JIT) VM access for all virtual machines.. Enabling Just-in-Time (JIT) VM access reduces the attack surface by locking down inbound traffic to Azure VMs, allowing only authorized users to open specific ports (e.g., RDP 3389, SSH 22) for a limited time. This directly improves the Secure Score because Microsoft Defender for Cloud includes JIT recommendations as a high-impact security control, and implementing it reduces the number of exposed management ports that attackers can target.

Answer

Configure auditing on all SQL databases.

Answer

Disable all low-severity security alerts in the subscription.

Answer

Install EDR agents on all on-premises servers.

Question 12

A security operations team has Microsoft Defender for Cloud enabled on all subscriptions and wants to forward security alerts and recommendations to Microsoft Sentinel for analysis and automation. Which configuration should the team implement to enable this integration?

Accepted Answer

In Microsoft Sentinel, add the 'Microsoft Defender for Cloud' data connector and select the subscriptions to stream alerts and recommendations.. Option A is correct because the 'Microsoft Defender for Cloud' data connector in Microsoft Sentinel is the native integration point that allows you to stream security alerts and recommendations from Defender for Cloud into Sentinel. By adding this connector and selecting the subscriptions, you enable a direct, bi-directional connection that ingests Defender for Cloud data into Sentinel's Log Analytics workspace for analysis and automation.

Answer

In Microsoft Defender for Cloud, create a continuous export to a Log Analytics workspace that is already connected to Sentinel.

Answer

Create an Azure Policy that deploys Azure Monitor Agent to all VMs and configures data collection rules to send data to Sentinel.

Answer

Enable the 'Enable integration with Microsoft Sentinel' option in the Defender for Cloud pricing & settings blade.

Question 13

A company wants to be alerted when a virtual machine is exposed to the internet through a permissive network security group rule. Which Microsoft Defender for Cloud feature provides recommendations and alerts for such misconfigurations?

Accepted Answer

Adaptive network hardening. Adaptive network hardening (ANH) in Microsoft Defender for Cloud analyzes actual traffic patterns, NSG rules, and internet-facing endpoints to identify overly permissive rules that expose VMs to the internet. It then provides actionable recommendations to tighten those rules and can generate security alerts when such misconfigurations are detected. This directly matches the requirement for alerts on internet exposure via permissive NSG rules.

Answer

Just-in-time VM access

Answer

File integrity monitoring

Answer

Application controls

Question 14

A security administrator wants to enable vulnerability assessment for all existing and future Azure virtual machines using the integrated Microsoft Defender Vulnerability Management solution. Which action should they take in Microsoft Defender for Cloud?

Accepted Answer

Enable 'Microsoft Defender for Servers' plan and check the 'Vulnerability assessment' option in the environment settings. To enable vulnerability assessment for all existing and future Azure VMs using the integrated Microsoft Defender Vulnerability Management solution, you must enable the 'Microsoft Defender for Servers' plan in Defender for Cloud and then check the 'Vulnerability assessment' option within the environment settings. This action activates the built-in, agentless vulnerability assessment engine that is part of Defender for Cloud, automatically scanning VMs without requiring additional agents or manual deployment.

Answer

Install the Log Analytics agent and configure the Qualys connector on each VM

Answer

Create a policy assignment from the built-in initiative 'Enable Azure Monitor for VMs'

Answer

Enable 'Servers' workload protection in Defender for Cloud and then manually deploy the VA agent to each existing VM using Azure Policy

Question 15

A security operations team uses Microsoft Defender for Cloud and Microsoft Sentinel. They want to automatically suppress low-severity security recommendations that are older than 90 days for a specific resource group. Which combination of tools should they use?

Accepted Answer

Use a suppression rule in Defender for Cloud to suppress specific recommendations. Option C is correct because Defender for Cloud includes native suppression rules that allow you to automatically dismiss low-severity recommendations based on criteria such as age (older than 90 days) and scope (specific resource group). This is the only built-in mechanism in Defender for Cloud to permanently suppress recommendations without altering the underlying security posture or requiring external automation.

Answer

Use Azure Policy to exempt the resource group from policy evaluation

Answer

Use a Microsoft Sentinel automation rule to close incidents

Answer

Use an Azure Blueprint to ignore recommendations