SC-200 Mitigate threats using Microsoft Defender for Cloud — Timed 30 Questions

Question 1

A security operations analyst is reviewing recommendations in Microsoft Defender for Cloud. For a virtual machine that is missing critical security updates, which recommendation category will highlight this issue?

Accepted Answer

Secure score. In Microsoft Defender for Cloud, the Secure score category directly reflects the security posture of your resources by tracking the implementation of security recommendations. Missing critical security updates on a virtual machine are flagged as a recommendation within this category, and resolving them improves your secure score percentage. This is because secure score is calculated based on the compliance status of each recommendation, with missing updates being a key control for vulnerability management.

Answer

Regulatory compliance

Answer

Workload protections

Answer

Inventory

Question 2

A security analyst is triaging security alerts in Microsoft Defender for Cloud. Which of the following are valid ways to suppress a specific alert type to reduce noise? (Choose all that apply.)

Accepted Answer

Create an alert suppression rule based on alert entity. Option A is correct because Microsoft Defender for Cloud allows you to create suppression rules that automatically dismiss alerts based on specific alert entities (such as alert ID, title, or severity) to reduce noise. These rules are configured in the security alerts settings and can be scoped to a subscription or management group, ensuring that alerts matching the defined criteria are silently dismissed without generating incidents.

Answer

Modify the alert's severity

Answer

Set an automatic response action

Question 3

A security analyst reviews Microsoft Defender for Cloud recommendations for an Azure virtual machine. The VM has a recommendation titled 'Install endpoint protection solution on virtual machines'. The analyst clicks on the recommendation and sees affected resources. Which of the following best describes the purpose of this recommendation in the context of Defender for Cloud?

Accepted Answer

It advises deploying a supported endpoint protection solution, such as Microsoft Defender Antivirus, to protect the VM from malware and other threats.. Option D is correct because the recommendation 'Install endpoint protection solution on virtual machines' in Microsoft Defender for Cloud specifically identifies VMs that lack a supported endpoint protection solution (e.g., Microsoft Defender Antivirus, Trend Micro, Symantec). Its purpose is to ensure that VMs are protected against malware, viruses, and other threats by deploying an endpoint protection solution, which is a core security control in the cloud security posture management (CSPM) framework.

Answer

It identifies VMs that have an open network security group inbound rule that should be closed.

Answer

It suggests enabling Azure Firewall on the virtual network to protect the VM from external threats.

Answer

It recommends enabling disk encryption for the VM's OS and data disks.

Question 4

A company uses Microsoft Defender for Cloud's Just-In-Time (JIT) VM access to secure its Azure virtual machines. A security analyst needs to grant a developer temporary RDP access to a specific VM for debugging purposes. Instead of using the default request approval flow, the analyst wants to configure an exemption so that the developer's access request never triggers a recommendation for that VM. Which action must the analyst perform?

Accepted Answer

Add an exemption for the VM on the 'Management ports should be closed on just-in-time based virtual machines' recommendation.. To prevent a specific VM from triggering a recommendation for open management ports, you must add an exemption directly on the 'Management ports should be closed on just-in-time based virtual machines' recommendation in Defender for Cloud. This exemption tells the recommendation engine to exclude that VM from compliance evaluation, so no alert or recommendation is generated for it. Approving a request with a long expiration does not suppress the underlying recommendation; it only grants temporary access.

Answer

Approve the access request once from the JIT blade and set a long expiration.

Answer

Configure a custom Azure Policy to allow open management ports for that VM.

Answer

Disable the JIT solution for the entire subscription from the Defender for Cloud environment settings.

Question 5

A company runs its critical workloads on Azure Kubernetes Service (AKS). The security team wants to use Microsoft Defender for Cloud to protect the AKS clusters. After enabling Defender for Cloud on the subscription, they also need to enable the Defender for Containers plan. Which of the following capabilities becomes available specifically after enabling the Defender for Containers plan (with the plan turned on)?

Accepted Answer

Security alerts for container runtime threats, such as privilege escalation in a container.. Option C is correct because enabling the Defender for Containers plan in Microsoft Defender for Cloud activates host-level and cluster-level threat detection for AKS, including runtime threat protection. This allows Defender for Cloud to generate security alerts for container-specific threats such as privilege escalation, container breakout, and suspicious process execution within containers, which are not available with just the basic Defender for Cloud enabled on the subscription.

Answer

Azure Policy for Kubernetes add-on installation to enforce pod security policies.

Answer

Kubernetes audit logs are automatically streamed to the Log Analytics workspace.

Answer

Integration with Microsoft Sentinel for monitoring AKS logs.

Question 6

A security analyst is using Microsoft Defender for Cloud's adaptive application controls (AAC) to allowlist trusted applications on Azure VMs. After enabling AAC and running in 'Audit' mode for a week, the analyst wants to switch to 'Enforce' mode. Which pre-requisite must be met before enforcement can be applied?

Accepted Answer

The VM must have a baseline of allowed applications generated from at least two weeks of audit data.. Adaptive application controls require a minimum of two weeks of audit data to establish a reliable baseline of allowed applications before enforcement can be applied. This baseline ensures that legitimate applications are not blocked when switching from Audit to Enforce mode, reducing false positives and operational disruptions.

Answer

The VM must have the Guest Configuration extension installed.

Answer

A valid Microsoft Defender for Servers Plan 2 license must be assigned to the VM.

Answer

The VM must be running on a supported operating system like Windows Server 2016 or later.

Question 7

A company uses Microsoft Defender for Cloud to protect Azure resources. They have an Azure SQL Database containing sensitive customer data. The security team wants to be alerted if a user attempts to perform SQL injection attacks against the database. Which Defender for Cloud plan must be enabled to receive SQL injection alerts?

Accepted Answer

Defender for SQL. Defender for SQL is the correct plan because it specifically provides threat detection for Azure SQL Database, including alerts for SQL injection attempts. It analyzes database audit logs and anomalous query patterns to detect SQL injection attacks, which are a primary threat to sensitive data in SQL databases.

Answer

Defender for Servers

Answer

Defender for Storage

Answer

Defender for App Service

Question 8

A security team uses Microsoft Defender for Cloud to protect Azure virtual machines. They notice that a VM is generating alerts for unusual outbound connections. The team wants to use a Defender for Cloud feature that learns the VM's typical network behavior and provides recommendations to tighten network security group rules, while also alerting on suspicious deviations. Which feature should they enable?

Accepted Answer

Adaptive network hardening. Adaptive network hardening (ANH) is the correct feature because it uses machine learning to learn a VM's typical traffic patterns (including outbound connections), then analyzes the current Network Security Group (NSG) rules against those learned patterns. It provides recommendations to tighten NSG rules to allow only the traffic that is actually used, and it generates security alerts when it detects deviations from the learned baseline, such as unusual outbound connections.

Answer

Just-In-Time VM access

Answer

File integrity monitoring

Answer

Vulnerability scanning

Question 9

A company has enabled Microsoft Defender for Cloud on its Azure subscription. The security team wants to ensure that all existing virtual machines have a vulnerability assessment solution installed. Which Defender for Cloud feature can automatically deploy a vulnerability assessment agent to supported VMs?

Accepted Answer

Vulnerability assessment recommendations. The Vulnerability Assessment (VA) recommendations in Microsoft Defender for Cloud can automatically deploy a vulnerability assessment agent (such as the Qualys or Microsoft Defender Vulnerability Management agent) to supported Azure VMs. When a VM is found to be missing a VA solution, Defender for Cloud can enable the 'Auto-provision' setting for the VA recommendation, which triggers the agent installation without manual intervention. This directly meets the requirement to ensure all existing VMs have a vulnerability assessment solution installed.

Answer

Defender for Servers plan

Answer

Security policies

Answer

Workload protections

Question 10

A company uses Microsoft Defender for Cloud to protect Azure virtual machines. The security team receives an alert indicating that a VM is communicating with a known malicious IP address. Which Defender for Cloud feature can be used to automatically block outbound traffic to that IP address by adjusting the network security group (NSG)?

Accepted Answer

Adaptive network hardening. Adaptive network hardening (C) is the correct feature because it uses machine learning to analyze traffic patterns and recommend NSG rules to restrict traffic to known trusted sources. When a VM communicates with a malicious IP, adaptive network hardening can automatically create a deny rule in the NSG to block outbound traffic to that IP, reducing the attack surface without manual intervention.

Answer

Adaptive application controls

Answer

Just-in-time VM access

Answer

File integrity monitoring

Question 11

A company has Azure virtual machines running Windows Server. The security team wants to use Microsoft Defender for Cloud's vulnerability assessment solution to identify missing security updates. Which of the following is required to enable built-in vulnerability assessment for VMs?

Accepted Answer

Enable Defender for Servers plan. The built-in vulnerability assessment solution in Microsoft Defender for Cloud for Azure VMs is powered by Qualys and is automatically provisioned when the Defender for Servers plan is enabled. This integration does not require manual agent installation or third-party solutions; enabling the plan activates the scanner on supported VMs to identify missing security updates and other vulnerabilities.

Answer

Install the Log Analytics agent manually

Answer

Configure a vulnerability assessment solution from Azure Marketplace

Answer

Enable the regulatory compliance dashboard

Question 12

A company uses Microsoft Defender for Cloud to protect Azure virtual machines. The security team wants to identify which VMs have missing system updates such as critical security patches. Which Defender for Cloud feature should they use?

Accepted Answer

Vulnerability assessment. Vulnerability assessment in Microsoft Defender for Cloud scans Azure VMs for missing system updates, including critical security patches, by integrating with built-in or partner vulnerability scanners (e.g., Qualys). This feature provides a continuous assessment of OS and application vulnerabilities, directly addressing the need to identify VMs with missing patches.

Answer

Adaptive application controls

Answer

Just-in-time VM access

Answer

File integrity monitoring

Question 13

An organization has enabled Microsoft Defender for Cloud's enhanced security features. They want to ensure that newly provisioned Azure virtual machines automatically have the built-in vulnerability assessment solution installed. Which configuration should they enable in Defender for Cloud?

Accepted Answer

Auto-provisioning of the vulnerability assessment solution. Option B is correct because Microsoft Defender for Cloud's enhanced security features include a dedicated auto-provisioning setting specifically for the built-in vulnerability assessment solution (powered by Qualys). When enabled, this setting automatically deploys the vulnerability assessment extension to all new and existing Azure VMs, ensuring continuous vulnerability scanning without manual intervention.

Answer

Auto-provisioning of the Log Analytics agent

Answer

Automatic provisioning of all security agents

Answer

Azure Policy assignment for Update Management

Question 14

A company wants to protect Azure virtual machines from brute force attacks by allowing remote desktop protocol (RDP) access only when explicitly requested and approved. Which Microsoft Defender for Cloud feature should they enable?

Accepted Answer

Just-in-time VM access. Just-in-time (JIT) VM access in Microsoft Defender for Cloud locks down inbound traffic to Azure VMs by default, opening RDP (port 3389) only when a user requests access and is approved via Azure AD and Azure Policy. This directly addresses the requirement to allow RDP only on explicit request and approval, mitigating brute force attacks by reducing the attack surface.

Answer

Adaptive network hardening

Answer

File integrity monitoring

Answer

Security recommendations

Question 15

A company enables Microsoft Defender for Cloud on its Azure subscription. The security team wants to ensure that all existing and future Azure VMs have Just-In-Time (JIT) VM access configured. Which of the following actions must the team take first to enable JIT for VMs?

Accepted Answer

Enable the 'Just-In-Time VM access' plan in Microsoft Defender for Cloud's environment settings. Option A is correct because enabling the 'Just-In-Time VM access' plan in Microsoft Defender for Cloud's environment settings is the prerequisite step that activates the JIT feature for the subscription. Without this plan enabled, Defender for Cloud cannot enforce JIT policies on any VMs, regardless of NSG or agent configurations.

Answer

Configure a network security group (NSG) to allow RDP traffic from a specific IP range

Answer

Create a security policy assignment to block all inbound RDP traffic

Answer

Install the Log Analytics agent on all VMs

Question 16

Match each Microsoft Defender for Cloud feature on the left with its primary purpose on the right.

Accepted Answer

Just-In-Time VM Access → Provides time-limited access to management ports via NSG rules; Adaptive Application Controls → Allowlists known safe applications to run on VMs; File Integrity Monitoring → Detects changes to sensitive registry keys and files; Regulatory Compliance Dashboard → Assesses Azure resources against industry standards. Option A is correct because it accurately matches each Microsoft Defender for Cloud feature to its primary purpose. Just-In-Time (JIT) VM Access reduces the attack surface by locking down management ports (e.g., RDP 3389, SSH 22) and granting time-limited access via NSG rules only when requested. Adaptive Application Controls uses machine learning to create an allowlist of known safe applications, blocking unknown executables on VMs. File Integrity Monitoring (FIM) tracks changes to sensitive registry keys, files, and certificates, alerting on unauthorized modifications. The Regulatory Compliance Dashboard continuously assesses Azure resources against built-in standards like CIS, NIST, and Azure Security Benchmark, providing a compliance score and recommendations.

Answer

The first and second mappings are reversed; the remaining mappings are unchanged.

Answer

All features map to the same monitoring purpose.

Answer

The compliance and access-control mappings are swapped.

Question 17

An analyst wants to enable the Defender for Containers plan in Microsoft Defender for Cloud to protect an Azure Kubernetes Service (AKS) cluster. Arrange the steps in the correct order.

Accepted Answer

1. Enable Microsoft Defender for Cloud on the subscription (if not already enabled). → 2. Go to Microsoft Defender for Cloud > Environment settings > Select the subscription. → 3. In the 'Defender plans' blade, toggle 'Containers' to On. → 4. (Optional) Install the Defender profile on the AKS cluster via recommendations or manually. → 5. Verify that container threat detection alerts appear in Defender for Cloud.. Option A is correct because it follows the logical sequence for enabling Defender for Containers: first ensure Defender for Cloud is enabled at the subscription level, then navigate to Environment settings, toggle the Containers plan on, optionally install the Defender profile on the AKS cluster (via the 'Azure Policy add-on for AKS' recommendation or manual helm chart), and finally verify threat detection alerts appear. This order ensures the plan is active before profile installation and validation.

Answer

Verify results before configuring the source or rule settings.

Answer

Configure alert grouping before defining the detection query or source.

Answer

Skip validation and enable the rule or plan immediately.

Question 18

A company uses Microsoft Defender for Cloud and wants to automatically ensure that all Azure virtual machines have a specific security configuration baseline applied (e.g., default password policies). Which Defender for Cloud feature should they leverage to audit and enforce these configurations inside the VMs?

Accepted Answer

Azure Policy Guest Configuration. Azure Policy Guest Configuration is the correct feature because it extends Azure Policy to audit and enforce configurations inside the operating system of Azure VMs, including security baseline settings like default password policies. Unlike host-level policies, Guest Configuration can evaluate and remediate settings within the guest OS, making it the appropriate tool for this requirement.

Answer

Security policies

Answer

Just-In-Time VM access

Answer

Adaptive application controls

Question 19

A company uses Microsoft Defender for Cloud and wants to automatically remediate non-compliant Azure resources by deploying missing configurations (e.g., enabling diagnostics when not enabled). Which feature should they enable?

Accepted Answer

Azure Policy's DeployIfNotExists effect. Azure Policy's DeployIfNotExists effect is the correct feature because it automatically remediates non-compliant Azure resources by deploying missing configurations, such as enabling diagnostic settings, when the resource is created or updated. This effect evaluates resources against a policy definition and, if the specified configuration does not exist, triggers a deployment task to apply the required settings. In Defender for Cloud, this is used to enforce security baselines by automatically correcting non-compliant resources without manual intervention.

Answer

Just-In-Time VM access

Answer

Adaptive network hardening

Answer

File integrity monitoring

Question 20

A company uses Microsoft Defender for Cloud with enhanced security features enabled. The security team wants to automatically disable the local administrative account on all existing and future Azure virtual machines by applying a guest configuration policy. Which Defender for Cloud feature should they use?

Accepted Answer

Guest configuration (Azure Policy). Option B is correct because Guest configuration (Azure Policy) is the only feature that can audit and remediate settings inside a virtual machine's operating system, such as disabling the local administrative account. Defender for Cloud integrates with Azure Policy's guest configuration extension to enforce desired state configurations on both existing and future VMs via policy assignments.

Answer

Just-In-Time (JIT) VM access

Answer

Adaptive application controls

Answer

Regulatory compliance dashboard