hardMultiple ChoiceObjective-mapped
SC-200 Practice Question: A company uses Microsoft Defender for Cloud with…
A company uses Microsoft Defender for Cloud with Defender for Servers enabled. The security team wants to receive an alert when a new user is added to the local Administrators group on a Windows virtual machine. Which data source must be enabled in Defender for Cloud to capture this event?
⚠ Common exam trap
Many candidates confuse data collection sources (e.g., JIT, AAC, or SQL Defender) with the specific Windows Security Event Log required to detect local group membership changes, assuming any security control can generate the alert.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable the collection of Windows Security Event Log events (e.g., Event ID 4732) through the Log Analytics agent configuration.
The event of adding a user to the local Administrators group on Windows is logged as Security Event ID 4732. To capture this event in Defender for Cloud, the Log Analytics agent must be configured to collect Windows Security Event Log events, which includes Event ID 4732. This data source enables Defender for Cloud to generate security alerts based on such privileged group modifications.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enable the collection of Windows Security Event Log events (e.g., Event ID 4732) through the Log Analytics agent configuration.
Why this is correct
Correct. Local group changes are captured via Windows security event 4732. To get this into Defender for Cloud, you must ensure the Log Analytics agent is collecting security events and that the required audit policies are in place.
- ✗
Enable Just-in-Time (JIT) VM access on the virtual machine.
Why it's wrong here
Just-in-Time (JIT) VM access restricts inbound traffic to management ports (RDP/SSH) by creating time-bound NSG rules when an admin requests access. It is a hardening control designed to reduce the attack surface for brute-force or credential-stuffing attacks, but it does not collect or analyze Windows Security Event Logs. JIT has no awareness of OS-level activities such as adding a user to the local Administrators group, so it cannot generate an alert for Event ID 4732. Therefore, enabling JIT will not satisfy the requirement to detect local group membership changes.
- ✗
Enable Adaptive Application Controls (AAC) for the virtual machine.
Why it's wrong here
Adaptive Application Controls (AAC) uses machine learning to establish an allowlist of known-safe executables for a VM and can generate alerts when an unauthorized application or process runs. Its detection scope is limited to process execution and file paths; it does not inspect Windows security audit events or monitor changes to security principal group membership. Adding a member to a local group is a directory/security event, not an application execution event, so AAC would remain oblivious to that activity. Consequently, enabling AAC cannot provide alerts for local group membership modifications.
- ✗
Enable Azure Defender for SQL on the subscription.
Why it's wrong here
Azure Defender for SQL provides threat protection for Azure SQL Database, SQL Managed Instance, and SQL on virtual machines, including vulnerability assessments, anomaly detection, and alerts for SQL injection and brute-force attempts. Its detection mechanisms operate at the database query layer and do not ingest or analyze Windows Security Event Logs from the host OS. Since a local group membership change like Event ID 4732 is a Windows security audit event, Azure Defender for SQL has no data source or detection rule that could capture it. Thus enabling Azure Defender for SQL is irrelevant to the requirement and will not generate the desired alerts.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SC-200 question from scratch — 209 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.