SC-200 Mitigate threats using Microsoft Defender for Cloud Practice Test 5 — 15 Questions

Question 1

A company uses Microsoft Defender for Cloud to secure its Azure environment. The security team wants to receive notifications via email whenever a high-severity security alert is generated. What should they configure in Defender for Cloud?

Accepted Answer

Set up email notifications for high-severity alerts in the Defender for Cloud environment settings.. Option C is correct because Defender for Cloud provides a built-in email notification configuration specifically for security alerts. By navigating to the 'Environment settings' for the subscription or management group, then selecting 'Email notifications', you can enable and configure alerts to be sent to specified recipients when high-severity alerts are generated. This is the direct, purpose-built method for email notification of Defender for Cloud alerts without requiring additional services.

Answer

Enable the 'Continuous Export' feature to send alerts to a Log Analytics workspace.

Answer

Configure an alert rule in Azure Monitor.

Answer

Create an automation rule in Microsoft Sentinel.

Question 2

A company uses Microsoft Defender for Cloud with enhanced security features enabled. They recently deployed a new Azure Kubernetes Service (AKS) cluster and want to ensure it is protected by Defender for Containers. What must they do to enable protection?

Accepted Answer

Enable the Defender for Containers plan for the subscription in Defender for Cloud.. Defender for Containers is a plan-level feature in Microsoft Defender for Cloud that must be enabled at the subscription level. Once enabled, it automatically discovers and protects AKS clusters without requiring any manual agent installation on nodes, as it uses the Defender sensor deployed by AKS itself. This is the only action needed to enable protection for the new AKS cluster.

Answer

Install the Microsoft Defender for Cloud agent on the AKS nodes.

Answer

Create a Log Analytics workspace and connect AKS to it.

Answer

Enable Azure Policy for AKS.

Question 3

A security administrator needs to view a list of all virtual machines that have a missing critical security update. Which Microsoft Defender for Cloud dashboard should they use?

Accepted Answer

Recommendations. The Recommendations dashboard in Microsoft Defender for Cloud provides a prioritized list of security recommendations, including missing critical security updates for virtual machines. This dashboard aggregates findings from vulnerability assessments and update management, allowing administrators to identify and remediate specific missing patches across their VM fleet.

Answer

Secure Score

Answer

Regulatory Compliance

Answer

Inventory

Question 4

A company wants to enable vulnerability scanning for Azure virtual machines using the integrated Microsoft Defender Vulnerability Management solution. What is the first step?

Accepted Answer

Enable the 'Servers' plan in Defender for Cloud.. The first step to enable vulnerability scanning for Azure VMs using the integrated Microsoft Defender Vulnerability Management solution is to enable the 'Servers' plan in Defender for Cloud. This plan activates the Defender for Cloud integration with Microsoft Defender Vulnerability Management, which automatically discovers and assesses vulnerabilities on supported Azure VMs without requiring any additional agent or extension installation. Once the plan is enabled, vulnerability assessment is performed natively by the Defender for Cloud platform.

Answer

Install the Defender Vulnerability Management extension on each VM.

Answer

Configure a vulnerability assessment solution in the VM's security settings.

Answer

Create a vulnerability assessment rule in Azure Policy.

Question 5

A security administrator is configuring Microsoft Defender for Cloud's regulatory compliance dashboard. The organization needs to be compliant with the NIST SP 800-53 standard. Which built-in initiative should the administrator assign to the subscription to populate the dashboard with NIST controls?

Accepted Answer

NIST SP 800-53 R5. The NIST SP 800-53 R5 built-in initiative is the correct choice because Microsoft Defender for Cloud includes a dedicated regulatory compliance policy initiative that maps directly to the NIST SP 800-53 standard's controls. Assigning this initiative to the subscription populates the regulatory compliance dashboard with the specific NIST controls and their compliance status, enabling the organization to track and report against that framework.

Answer

Azure Security Benchmark

Answer

CIS Microsoft Azure Foundations Benchmark

Answer

ISO 27001

Question 6

A company has enabled Microsoft Defender for Cloud on multiple Azure subscriptions. The security team wants to view a unified security score that aggregates the scores from all subscriptions. Which feature should they use?

Accepted Answer

Secure Score dashboard. The Secure Score dashboard in Microsoft Defender for Cloud aggregates the security scores from all selected subscriptions into a single, unified score. This allows the security team to view the overall security posture across multiple Azure subscriptions at a glance, based on the compliance status of security recommendations.

Answer

Azure Policy compliance dashboard

Answer

Security alerts dashboard

Answer

Workload protection dashboard

Question 7

A cloud security administrator receives an alert from Microsoft Defender for Cloud indicating that a virtual machine has been compromised. The administrator wants to quickly isolate the VM from the network to prevent further spread while preserving the disk for forensic analysis. Which action should the administrator take?

Accepted Answer

Use the "Isolate VM" action in the security alert.. The 'Isolate VM' action in Microsoft Defender for Cloud is designed specifically for compromised VMs. It applies a network security group (NSG) rule that denies all inbound and outbound traffic to the VM, effectively quarantining it from the network while leaving the disk intact for forensic analysis. This is the fastest and most direct method to contain the threat without altering the VM's configuration or disk state.

Answer

Apply a just-in-time (JIT) access policy to the VM.

Answer

Enable the Azure Security Benchmark initiative for the VM.

Answer

Configure a custom Azure Policy to deny network access.

Question 8

A cloud security team uses Microsoft Defender for Cloud with Defender for Servers enabled. They want to integrate a third-party vulnerability assessment solution for their Azure VMs and ensure findings appear in the Defender for Cloud recommendations. What must be done?

Accepted Answer

Enable the 'Integrated' partner solution in Defender for Cloud and install the scanner on VMs.. Option B is correct because Defender for Cloud supports integrating third-party vulnerability assessment solutions through the 'Integrated' partner solution setting. Once enabled, you must install the partner's scanner agent on each Azure VM. The findings are then ingested into Defender for Cloud and appear in the 'Vulnerabilities in your virtual machines should be remediated' recommendation, allowing the security team to view and manage them alongside built-in assessments.

Answer

Configure a data connector in Microsoft Sentinel to forward the partner's findings.

Answer

Deploy the Microsoft Defender Vulnerability Management solution instead of a third-party tool.

Answer

Use Azure Policy to assign a built-in initiative that mandates vulnerability scanning.

Question 9

A security administrator wants to ensure that all Azure virtual machines have automatic provisioning of the Log Analytics agent enabled by default in Microsoft Defender for Cloud. Where should this configuration be set?

Accepted Answer

In Microsoft Defender for Cloud, under 'Environment settings' > 'Data collection'. Option B is correct because the automatic provisioning of the Log Analytics agent for all Azure virtual machines in Defender for Cloud is configured under 'Environment settings' > 'Data collection'. This setting enables Defender for Cloud to automatically deploy the Log Analytics agent to new and existing VMs, ensuring security monitoring without manual intervention.

Answer

In the Azure portal under each virtual machine's 'Extensions + applications' blade

Answer

In Microsoft Sentinel, under 'Data connectors' for Defender for Cloud

Answer

In Azure Policy, by assigning the 'Deploy Log Analytics agent' initiative

Question 10

A company uses Microsoft Defender for Cloud with enhanced security features enabled. They have an Azure subscription with many VMs that are all protected by Defender for Servers. The security team wants to identify VMs that have not had a vulnerability assessment scan in the last 7 days. The integrated vulnerability assessment (Microsoft Defender Vulnerability Management) is enabled. Which KQL query in Azure Resource Graph or Log Analytics can achieve this?

Accepted Answer

securityresources | where type == 'microsoft.security/assessments' and properties.displayName == 'Vulnerability assessment solution should be enabled on your virtual machines' and properties.status.code == 'Healthy' | project id, properties.timeGenerated | where properties.timeGenerated < ago(7d). Option B is correct because it queries the 'securityresources' table in Azure Resource Graph for assessments where the display name matches 'Vulnerability assessment solution should be enabled on your virtual machines' and the status code is 'Healthy'. A 'Healthy' status indicates the assessment passed, meaning a scan occurred within the configured period. By filtering for 'properties.timeGenerated < ago(7d)', it identifies VMs where the last scan was more than 7 days ago, directly meeting the requirement.

Answer

securityresources | where type == 'microsoft.security/assessments' | summarize arg_max(properties.status.severity, properties.timeGenerated) by id

Answer

resources | where type == 'microsoft.compute/virtualmachines' | join kind=leftouter (securityresources) on $left.id == $right.id

Answer

operationalinsights | where TimeGenerated < ago(7d)

Question 11

A company uses Microsoft Defender for Cloud with enhanced security features enabled. They have several Azure virtual machines running SQL Server. The security team wants to enable advanced threat protection for their Azure SQL databases. What should they do?

Accepted Answer

Enable Microsoft Defender for SQL on the subscription.. Microsoft Defender for SQL (formerly Advanced Threat Protection for Azure SQL) is the specific plan that provides threat detection for Azure SQL databases, including SQL Server on Azure VMs. Enabling it at the subscription level ensures all existing and future Azure SQL databases under that subscription are protected, which is the recommended and most efficient approach.

Answer

Enable Microsoft Defender for Servers on the subscription.

Answer

Enable Microsoft Defender for Database on the subscription.

Answer

Configure SQL Vulnerability Assessment in the Azure portal for each database.

Question 12

A large enterprise uses Microsoft Defender for Cloud with all enhanced security plans enabled. They want to automatically enable the Defender for Cloud plans on new Azure subscriptions that are created under their management group. Which approach should they use?

Accepted Answer

Assign the built-in Azure Policy initiative 'Enable Microsoft Defender for Cloud on all subscriptions' at the management group level.. Option A is correct because the built-in Azure Policy initiative 'Enable Microsoft Defender for Cloud on all subscriptions' is designed to be assigned at a management group scope, automatically enabling all Defender for Cloud plans on new subscriptions as they are created under that management group. This leverages Azure Policy's compliance evaluation and remediation tasks to enforce the security plans across the entire hierarchy without manual intervention.

Answer

Configure 'Continuous export' settings in Defender for Cloud to export policies to Log Analytics for each subscription.

Answer

Set the default security policies at the management group level in Defender for Cloud's environment settings.

Answer

Enable 'Auto provisioning' for the Log Analytics agent in Defender for Cloud.

Question 13

A large enterprise uses Microsoft Defender for Cloud with the integrated Microsoft Defender Vulnerability Management solution enabled for all servers. The security team wants to identify all virtual machines that have not been scanned for vulnerabilities in the last 7 days. They plan to use Azure Resource Graph (ARG) to generate a report. Which KQL query would correctly identify these machines?

Accepted Answer

securityresources | where type =~ 'microsoft.security/assessments' and name == '4da3e7e8-0e4b-4c5e-8e0a-7e8f4e8e4e8e' | where properties.status.code == 'Unhealthy' and properties.status.firstEvaluationDate < ago(7d). Option A is correct because it queries the `securityresources` table for the specific vulnerability assessment type (`microsoft.security/assessments`) and filters for the vulnerability assessment result named with the GUID `4da3e7e8-0e4b-4c5e-8e0a-7e8f4e8e4e8e`, which corresponds to the 'Vulnerabilities in your virtual machines should be remediated' assessment. It then checks that the status code is 'Unhealthy' (indicating vulnerabilities were found) and that the `firstEvaluationDate` is older than 7 days, which identifies machines that have not been scanned recently.

Answer

resources | where type =~ 'microsoft.compute/virtualmachines' | where properties.storageProfile.osDisk.managedDisk.id != ''

Answer

securityresources | where type =~ 'microsoft.security/regulatorycompliancestandards'

Answer

resources | where type =~ 'microsoft.security/securitystatuses'

Question 14

A company uses Microsoft Defender for Cloud with enhanced security features enabled. The security team wants to view a consolidated list of all security recommendations across multiple Azure subscriptions in a single view. Which blade should they navigate to in the Microsoft Defender for Cloud portal?

Accepted Answer

Security posture. The Security posture blade in Microsoft Defender for Cloud provides a consolidated view of all security recommendations across multiple Azure subscriptions, enabling the security team to assess and prioritize improvements. This blade aggregates recommendations from various security controls and displays them in a single, unified interface, directly addressing the requirement for a consolidated list.

Answer

Regulatory compliance

Answer

Workload protections

Answer

Inventory

Question 15

A cloud security administrator needs to ensure that all Azure virtual machines have the Microsoft Defender for Cloud agent (Log Analytics agent) installed automatically when they are provisioned. Which configuration should be set in Microsoft Defender for Cloud?

Accepted Answer

Enable auto-provisioning in the Defender for Cloud environment settings.. Option A is correct because Microsoft Defender for Cloud includes an auto-provisioning setting that, when enabled, automatically installs the Log Analytics agent (Microsoft Monitoring Agent) on all existing and newly provisioned Azure virtual machines. This setting is configured in the Defender for Cloud environment settings under 'Auto provisioning' and ensures seamless coverage without manual intervention or additional policy management.

Answer

Deploy a custom Azure Policy to install the agent on all VMs.

Answer

Use an Azure Automation runbook to install the agent on newly created VMs.

Answer

Enable Azure Update Management on the VMs.