SC-200 Practice Question: A cloud security team uses Microsoft Defender for…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  In Microsoft Defender for Cloud > Environment settings > Select subscription > Settings & monitoring > Log Analytics agent for Azure VMs > Set to 'On'

  Why this is correct

  This is the correct path because Microsoft Defender for Cloud's integrated automatic provisioning is managed under Environment settings for the subscription, then Settings & monitoring, where the Log Analytics agent for Azure VMs toggle is enabled. Turning this on ensures the agent is deployed to every existing and future Azure VM in that subscription without individual manual action. This setting is purpose-built for Defender for Cloud's security data collection and is the authoritative way to satisfy the requirement.

• ✗

  In Azure Policy > Assign a policy that deploys the Log Analytics agent to VMs

  Why it's wrong here

  Assigning an Azure Policy to deploy the Log Analytics agent directly fails this scenario because the requirement is to enable *automatic provisioning* within Microsoft Defender for Cloud for its security data collection, not merely to install the agent via a separate mechanism. Defender for Cloud has a specific setting to manage this integrated provisioning for its Defender for Servers offering. This option is tempting as Azure Policy is ideal for enforcing agent deployment and configuration across VMs for general monitoring or compliance requirements independent of Defender for Cloud's integrated security data collection.

• ✗

  In Microsoft Defender for Cloud > Security policy > Data collection

  Why it's wrong here

  The 'Data collection' blade within Security policy is not the correct location because it only configures which Log Analytics workspace will receive security events and sets data retention options; it does not control whether the Log Analytics agent is automatically provisioned to VMs. In the Defender for Cloud interface, 'Data collection' lacks any toggle for agent installation, and relying on it would leave the agent uninstalled on VMs. Automatic provisioning is a distinct setting that must be activated separately under Settings & monitoring.

• ✗

  In Azure virtual machine blade > Auto-provisioning

  Why it's wrong here

  The Azure VM blade's 'Auto-provisioning' page is unrelated to Microsoft Defender for Cloud's agent installation; it refers to IaaS VM backup auto-provisioning, which configures Recovery Services vault backups for the VM. Enabling it would not install the Log Analytics agent, nor would it provide the security data collection required by Defender for Cloud. This option also operates per-VM rather than at subscription scope, so it cannot automatically cover future VMs across the entire subscription.