SC-200 Practice Question: A cloud security team uses Microsoft Defender for…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Configure a data connector in Microsoft Sentinel to forward the partner's findings.

  Why it's wrong here

  Configuring a Microsoft Sentinel data connector ingests logs and alerts into the SIEM for incident investigation, but it does not register third-party vulnerability scanner findings within Defender for Cloud's recommendations. Vulnerability assessment findings are only surfaced in Defender for Cloud when a partner solution is connected through the vulnerability assessment settings. A Sentinel connector would require custom analytics rules and would not feed the same compliance and risk reporting.

• ✓

  Enable the 'Integrated' partner solution in Defender for Cloud and install the scanner on VMs.

  Why this is correct

  In Defender for Cloud, the Vulnerability assessment settings let you enable an integrated partner solution such as Qualys or Rapid7; after selecting the partner, you install the designated scanner agent on each virtual machine. The scanner transmits identified vulnerabilities to Defender for Cloud, which ingests them into the recommendation 'Vulnerabilities in your virtual machines should be remediated' and includes them in the secure score and regulatory compliance assessments. This is the only mechanism that directly integrates the existing third-party tool's findings into Defender for Cloud.

• ✗

  Deploy the Microsoft Defender Vulnerability Management solution instead of a third-party tool.

  Why it's wrong here

  Switching to Microsoft Defender Vulnerability Management replaces the partner tool with a different Microsoft agent and platform, which would require separate deployment, licensing, and potentially uninstalling the third-party scanner. The question specifically concerns integrating an existing third-party solution, not whether a different scanner is better suited. Consequently, this option does not explain how to leverage the current partner's findings and would change the security stack rather than connect it.

• ✗

  Use Azure Policy to assign a built-in initiative that mandates vulnerability scanning.

  Why it's wrong here

  Assigning an Azure Policy initiative, such as one that deploys a vulnerability assessment agent, can ensure scanner installation on compliant VMs, but the policy itself cannot authorize Defender for Cloud to retrieve and display results from a third-party scanner. After the scanner is running, you must still configure the integrated partner solution in Defender for Cloud's vulnerability assessment blade to consume those findings. The policy only addresses deployment automation, not the integration of findings into recommendations.