SC-200 Practice Question: A company uses Microsoft Defender for Cloud to…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Enable the 'Continuous Export' feature to send alerts to a Log Analytics workspace.

  Why it's wrong here

  Continuous Export in Microsoft Defender for Cloud is designed to stream security alerts and recommendations to a Log Analytics workspace or Event Hub for long-term retention, integration with SIEMs, or custom analytics. It does not have any native capability to generate email notifications; it merely forwards raw data for downstream processing. Therefore, while it can help centralize alert data, it is not the appropriate mechanism to directly email security personnel about high-severity alerts.

• ✗

  Configure an alert rule in Azure Monitor.

  Why it's wrong here

  Azure Monitor alert rules are a general-purpose alerting mechanism for metrics and logs across Azure resources, and they can be configured to send emails. However, Defender for Cloud already generates its own security alerts and provides a dedicated, built-in email notification feature that is managed within the Defender for Cloud environment settings. Using Azure Monitor would require creating duplicate rules and manually mapping alert conditions, which is unnecessary and less integrated than using the native Defender for Cloud email configuration, making it a suboptimal choice for this requirement.

• ✓

  Set up email notifications for high-severity alerts in the Defender for Cloud environment settings.

  Why this is correct

  In Microsoft Defender for Cloud, the correct way to receive email notifications for high-severity alerts is to navigate to the environment settings, select the subscription's settings, and then configure the email notifications pane. There you can specify security contact email addresses and choose the severity levels (e.g., high severity) for which notifications should be sent. This native feature is purpose-built for directly alerting security teams via email when critical vulnerabilities are detected, ensuring timely awareness without relying on external workflows.

• ✗

  Create an automation rule in Microsoft Sentinel.

  Why it's wrong here

  Microsoft Sentinel automation rules are used to trigger automated responses—such as creating incidents, assigning owners, or running playbooks—based on analytics rules or incidents, not to forward Defender for Cloud alerts via email. While Sentinel can ingest Defender for Cloud alerts and orchestrate email via Logic Apps, that approach is far more complex and indirect than the simple, native email notification settings available directly in Defender for Cloud. The question specifically asks about Defender for Cloud's capabilities, so an automation rule in Sentinel is not the correct solution for sending email alerts.

Go deeper

Related to this question