SC-200 Practice Question: A company uses Microsoft Defender for Cloud with…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  In the Microsoft Defender for Cloud 'Security alerts' page.

  Why this is correct

  All Defender for Cloud security alerts—whether they originate from Azure, hybrid, multicloud, or container workloads—are aggregated in the unified Security alerts page. This page is the default and authoritative console for viewing, filtering, and triaging alerts generated by Defender for Cloud's plans, including Defender for Containers. Container-specific findings appear here with the relevant resource, severity, and associated MITRE ATT&CK tactics, making it the correct location for this scenario.

• ✗

  In Microsoft Sentinel incidents.

  Why it's wrong here

  Microsoft Sentinel can ingest Defender for Cloud alerts via the Security Alerts data connector to build incident timelines and run automated response playbooks, but it requires explicit configuration and is an optional SIEM layer. Without that connector, Sentinel does not receive or display any Defender for Cloud alerts. The question asks where a company 'uses' Defender for Cloud would see the alerts in the normal product experience, which is directly in Defender for Cloud's Security alerts page—not in Sentinel unless it has been deliberately integrated.

• ✗

  In the Microsoft 365 Defender portal.

  Why it's wrong here

  The Microsoft 365 Defender portal consolidates signals from Microsoft 365 security products such as Defender for Endpoint, Defender for Office 365, and Defender for Identity. It does not natively ingest Defender for Cloud alerts unless you enable the cross-product integration that forwards them to the unified incident queue, and even then the originating experience remains Defender for Cloud. For a customer solely using Defender for Cloud, the portal will not show container alerts by default, so this is not the correct answer.

• ✗

  In Azure Monitor alerts.

  Why it's wrong here

  Azure Monitor alerts are designed for detecting operational conditions in Azure resources based on metrics, logs, and activity log events—not for surfacing curated, threat-detection alerts generated by Defender for Cloud. While you can route Defender for Cloud alerts to Azure Monitor for archiving or custom automation, they are not displayed as Azure Monitor alert rules in the Azure Monitor alerts page. The native alert management experience for Defender for Cloud is the Security alerts page, which provides the investigation context and remediation steps specific to security findings.

Go deeper

Related to this question