SC-200 Mitigate threats using Microsoft Defender for Cloud Practice Test 6 — 15 Questions

Question 1

A company uses Microsoft Defender for Cloud with Defender for Containers enabled. The security team wants to view security alerts generated for their Azure Kubernetes Service (AKS) clusters. Where should they navigate to see these alerts?

Accepted Answer

In the Microsoft Defender for Cloud 'Security alerts' page.. Microsoft Defender for Cloud is the central console for security alerts generated by Defender for Containers, including those for AKS clusters. The 'Security alerts' page within Defender for Cloud aggregates all cloud workload protection alerts, making it the correct location to view AKS-specific alerts. Alerts from Defender for Containers are automatically surfaced here without additional configuration.

Answer

In Microsoft Sentinel incidents.

Answer

In the Microsoft 365 Defender portal.

Answer

In Azure Monitor alerts.

Question 2

A company uses Microsoft Defender for Cloud with Defender for Servers enabled. The security team wants to integrate a third-party vulnerability assessment solution (e.g., Qualys) and have findings appear in the Defender for Cloud recommendations. What must be done?

Accepted Answer

Install the Qualys agent on the VMs and configure the vulnerability assessment solution in Defender for Cloud.. Option A is correct because to integrate a third-party vulnerability assessment solution like Qualys with Microsoft Defender for Cloud, you must install the Qualys agent on the VMs and then configure the vulnerability assessment solution in Defender for Cloud. This allows Defender for Cloud to receive and display the vulnerability findings from Qualys as part of its security recommendations. Without this explicit configuration, Defender for Cloud cannot ingest third-party scanner data.

Answer

Enable the built-in Microsoft Defender Vulnerability Management (MDVM) solution; it automatically integrates with any third-party scanner.

Answer

Set up automatic provisioning of the Log Analytics agent and enable vulnerability assessment in the regulatory compliance dashboard.

Answer

Nothing; Defender for Cloud automatically scans all Azure VMs for vulnerabilities using the integrated Qualys scanner.

Question 3

A company uses Microsoft Defender for Cloud with Defender for Servers enabled. The security team wants to receive an alert when a new user is added to the local Administrators group on a Windows virtual machine. Which data source must be enabled in Defender for Cloud to capture this event?

Accepted Answer

Enable the collection of Windows Security Event Log events (e.g., Event ID 4732) through the Log Analytics agent configuration.. Option A is correct because the event of adding a user to the local Administrators group on Windows is logged as Security Event ID 4732. To capture this event in Defender for Cloud, the Log Analytics agent must be configured to collect Windows Security Event Log events, which includes Event ID 4732. This data source enables Defender for Cloud to generate security alerts based on such privileged group modifications.

Answer

Enable Just-in-Time (JIT) VM access on the virtual machine.

Answer

Enable Adaptive Application Controls (AAC) for the virtual machine.

Answer

Enable Azure Defender for SQL on the subscription.

Question 4

A company has several Azure virtual machines running SQL Server (IaaS). The security team wants to enable Advanced Threat Protection for these SQL Server instances to detect threats like SQL injection. What should they do?

Accepted Answer

Deploy the SQL Server IaaS Agent extension on each VM and enable Azure Defender for SQL in Microsoft Defender for Cloud.. To enable Advanced Threat Protection for SQL Server IaaS, you must deploy the SQL Server IaaS Agent extension on each VM, which allows the VM to register with the SQL IaaS platform. Then, you enable Azure Defender for SQL in Microsoft Defender for Cloud, which provides threat detection for SQL injection and other anomalous activities. This combination ensures the SQL Server instances are monitored by Defender for Cloud's SQL-specific protections.

Answer

Enable Azure Defender for Servers on the subscription; it automatically protects SQL Server workloads.

Answer

Enable Azure Defender for SQL on the Log Analytics workspace used by the VMs.

Answer

Configure the Microsoft Sentinel SQL connector to ingest SQL audit logs.

Question 5

A large organization manages multiple Azure subscriptions under a single management group. The security team wants to ensure that when new subscriptions are added to the management group, the Microsoft Defender for Cloud plans (e.g., Defender for Servers) are automatically enabled. What is the most efficient way to achieve this?

Accepted Answer

Assign the Azure Policy initiative 'Configure Azure Defender to be enabled on subscriptions' to the management group with appropriate policy parameters.. Option A is correct because assigning the built-in Azure Policy initiative 'Configure Azure Defender to be enabled on subscriptions' to the management group ensures that any new subscription added under that management group automatically inherits the policy. This initiative uses DeployIfNotExists effect to enable the specified Defender plans (e.g., Defender for Servers) on subscriptions that do not already have them enabled, providing a fully automated, scalable solution without manual intervention.

Answer

Enable all Microsoft Defender plans at the management group level in the Microsoft Defender for Cloud portal.

Answer

Manually enable the Defender plans on each new subscription as they are created.

Answer

Use an Azure Blueprint to assign the Defender plans to the subscription.

Question 6

A cloud security team uses Microsoft Defender for Cloud with Defender for Servers enabled. They want to ensure that all Azure virtual machines have automatic provisioning of the Log Analytics agent (Azure Monitor Agent) turned on. Where should this configuration be set to cover existing and future VMs?

Accepted Answer

In Microsoft Defender for Cloud > Environment settings > Select subscription > Settings & monitoring > Log Analytics agent for Azure VMs > Set to 'On'. Option A is correct because the 'Settings & monitoring' pane under Environment settings in Microsoft Defender for Cloud is the centralized location to enable automatic provisioning of the Log Analytics agent (Azure Monitor Agent) at the subscription level. This setting ensures that both existing Azure VMs and any future VMs are automatically provisioned with the agent, without requiring individual VM configuration or manual policy assignment.

Answer

In Azure Policy > Assign a policy that deploys the Log Analytics agent to VMs

Answer

In Microsoft Defender for Cloud > Security policy > Data collection

Answer

In Azure virtual machine blade > Auto-provisioning

Question 7

A company runs SQL Server on Azure Virtual Machines (IaaS). The security team wants to enable Advanced Threat Protection (ATP) to detect threats like SQL injection against these SQL Server instances. Which single action is required to achieve this?

Accepted Answer

Enable Microsoft Defender for SQL on the Azure subscription or at the SQL Server resource level.. To enable Advanced Threat Protection (ATP) for SQL Server on Azure VMs, you must enable Microsoft Defender for SQL at the Azure subscription or SQL Server resource level. This activates the SQL-specific threat detection capabilities, including alerts for SQL injection, anomalous access patterns, and suspicious activities. Without this, the SQL Server instances lack the dedicated security monitoring that ATP provides.

Answer

Install the SQL Server IaaS Agent extension on each virtual machine.

Answer

Enable just Microsoft Defender for Servers on the subscription.

Answer

Configure an Azure SQL firewall rule to allow only trusted IP addresses.

Question 8

A large enterprise uses Microsoft Defender for Cloud with all enhanced security plans (e.g., Defender for Servers, Defender for SQL) enabled on a management group. The security team wants to automatically enable these plans on new Azure subscriptions that are created under this management group. Which approach is the most efficient and scalable?

Accepted Answer

Use an Azure Policy definition that enforces the Microsoft Defender for Cloud pricing tier (Standard) at the management group scope.. Azure Policy can be assigned at the management group scope to enforce the 'Standard' pricing tier for Microsoft Defender for Cloud on all current and future subscriptions. This ensures that when a new subscription is created under that management group, the policy automatically evaluates and remediates the subscription to enable the required Defender plans, providing a fully automated, scalable, and governance-driven approach without manual intervention or custom scripting.

Answer

Manually enable the plans for each new subscription when it is created.

Answer

Create an Azure Automation runbook that runs on a schedule and enables plans for all subscriptions under the management group.

Answer

Use Azure Blueprints to define the Defender for Cloud settings in the blueprint definition.

Question 9

A security administrator needs to ensure that all newly provisioned Azure virtual machines automatically install the Microsoft Defender for Cloud agent (Log Analytics agent) to enable security monitoring. Which configuration should be enabled in Defender for Cloud?

Accepted Answer

Auto-provisioning of the Log Analytics agent. Auto-provisioning of the Log Analytics agent in Microsoft Defender for Cloud automatically installs the Log Analytics agent (Microsoft Monitoring Agent) on all new Azure VMs. This ensures that security monitoring data, such as security events and syslog, is collected and sent to the Log Analytics workspace without manual intervention. The setting is found under 'Environment settings' > 'Auto provisioning' and must be toggled to 'On' for the agent to be deployed on newly provisioned VMs.

Answer

Enable the Defender for Servers plan

Answer

Configure a vulnerability assessment solution

Answer

Enable just-in-time (JIT) VM access

Question 10

A company manages multiple Azure subscriptions under a single management group. The security team wants to enable Microsoft Defender for Cloud's enhanced security features (e.g., Defender for Servers) for all subscriptions under that management group with minimal administrative effort. Which method should they use?

Accepted Answer

Enable the plans at the management group level. Enabling Microsoft Defender for Cloud's enhanced security features at the management group level applies the plans to all current and future subscriptions under that management group with a single action, minimizing administrative effort. This is the most efficient method because Defender for Cloud supports inheritance of security policies and plans from the management group down to subscriptions, eliminating the need for per-subscription configuration.

Answer

Enable the plans individually on each subscription

Answer

Use Azure Blueprints to assign the plans to each subscription

Answer

Create a custom Azure Policy that enforces the installation of the Log Analytics agent

Question 11

A security team uses Microsoft Defender for Cloud with Defender for Servers enabled. They want to receive an alert whenever a new local user is added to the Administrators group on any Azure Windows virtual machine. Which data source must be configured in Defender for Cloud to capture this event?

Accepted Answer

Windows Security Events (Event ID 4732). Option A is correct because the addition of a user to the Administrators group on a Windows system generates Windows Security Event ID 4732. Defender for Cloud with Defender for Servers must have the 'Windows Security Events' data source configured to collect these audit events, which then triggers a security alert for the new local administrator.

Answer

Windows Defender Antivirus logs

Answer

Azure Activity Logs

Answer

VM Insights

Question 12

A security administrator wants to quickly view the overall security posture of all Azure subscriptions under a single management group that are monitored by Microsoft Defender for Cloud. Where in the Azure portal should they navigate?

Accepted Answer

Microsoft Defender for Cloud overview page. The Microsoft Defender for Cloud overview page provides a unified dashboard that displays the secure score, regulatory compliance, and security alerts across all subscriptions under a management group. This is the default landing page for assessing the overall security posture, aggregating data from all monitored subscriptions in a single view.

Answer

Azure Monitor

Answer

Azure Policy Compliance dashboard

Answer

Azure Advisor

Question 13

A company uses Microsoft Defender for Cloud with Defender for Servers enabled. They also run SQL Server on Azure Virtual Machines (IaaS). The security team wants to enable Advanced Threat Protection (ATP) for these SQL Server IaaS instances to detect threats like SQL injection. What is the single most effective action to achieve this?

Accepted Answer

Enable the Defender for SQL plan on the management group or subscription. The Defender for SQL plan in Microsoft Defender for Cloud provides Advanced Threat Protection (ATP) for Azure SQL Database, Azure SQL Managed Instance, and SQL Server on Azure VMs. Enabling this plan at the management group or subscription level automatically protects all current and future SQL Server IaaS instances within that scope, including threat detection for SQL injection attacks, without requiring per-VM agent installation.

Answer

Install the SQL IaaS Agent extension on each VM

Answer

Configure a vulnerability assessment solution on each SQL Server

Answer

Enable Azure SQL Database Threat Detection policy

Question 14

An organization manages multiple Azure subscriptions under a single management group. They want to automatically enable Microsoft Defender for Cloud's enhanced security plans (e.g., Defender for Servers) on any new subscription added to the management group. Which configuration method should they use?

Accepted Answer

Create an Azure Policy that assigns the Defender for Cloud pricing tier at the management group level. Option A is correct because Azure Policy can be assigned at the management group scope to enforce the 'Configure Microsoft Defender for Cloud plans to be enabled' policy, which automatically sets the pricing tier (e.g., Standard) for Defender for Servers on any new subscription added to that management group. This ensures compliance without manual intervention, as the policy evaluates and remediates new subscriptions upon creation or addition.

Answer

Enable auto-provisioning in Defender for Cloud's settings

Answer

Use Azure Blueprints to define the subscription configurations

Answer

Manually enable plans per subscription as they are added

Question 15

A company runs SQL Server on Azure Virtual Machines (IaaS). They want to enable Advanced Threat Protection (ATP) for these instances to detect SQL injection attempts. What must they do first?

Accepted Answer

Enable Azure Defender for SQL on the server. Azure Defender for SQL is the specific plan within Microsoft Defender for Cloud that provides Advanced Threat Protection (ATP) for Azure SQL resources, including SQL Server on Azure VMs. Enabling this plan activates threat detection capabilities such as SQL injection alerts, anomalous access patterns, and vulnerability assessments. Without this plan, the VM's SQL Server instance is not monitored by Defender for Cloud's SQL-specific threat detection engine.

Answer

Deploy the Azure Security Center agent on the VM

Answer

Enable Azure Defender for Servers

Answer

Configure SQL Server auditing manually