SC-200 Practice Question: Mitigate threats using Microsoft Defender for Cloud
This SC-200 practice question tests your understanding of mitigate threats using microsoft defender for cloud. Match the stated requirement to the specific cloud service, access model, or configuration option — many options are valid in isolation but not for this scenario. A key principle to apply: defender for Containers is enabled at the subscription level in Defender for Cloud.. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A company uses Microsoft Defender for Cloud with enhanced security features enabled. They recently deployed a new Azure Kubernetes Service (AKS) cluster and want to ensure it is protected by Defender for Containers. What must they do to enable protection?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable the Defender for Containers plan for the subscription in Defender for Cloud.
Defender for Containers is a plan-level feature in Microsoft Defender for Cloud that must be enabled at the subscription level. Once enabled, it automatically discovers and protects AKS clusters without requiring any manual agent installation on nodes, as it uses the Defender sensor deployed by AKS itself. This is the only action needed to enable protection for the new AKS cluster.
Key principle: Defender for Containers is enabled at the subscription level in Defender for Cloud.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✓
Enable the Defender for Containers plan for the subscription in Defender for Cloud.
Why this is correct
This enables the workload protection plan for containers, which automatically covers AKS clusters in the subscription.
Related concept
Defender for Containers is enabled at the subscription level in Defender for Cloud.
✗
Install the Microsoft Defender for Cloud agent on the AKS nodes.
Why it's wrong here
Defender for Containers does not require manual agent installation; it uses Azure Arc-enabled Kubernetes and other native capabilities.
✗
Create a Log Analytics workspace and connect AKS to it.
Why it's wrong here
While Log Analytics is used for data ingestion, it is not the primary step to enable protection; the plan must be enabled first.
✗
Enable Azure Policy for AKS.
Why it's wrong here
Azure Policy can enforce compliance, but it does not enable the Defender for Containers protection plan.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates often assume agent installation or Log Analytics workspace configuration is necessary for container protection, but Defender for Containers is a subscription-level plan that automatically provisions the required sensor without manual node-level setup.
Detailed technical explanation
How to think about this question
Under the hood, when the Defender for Containers plan is enabled for a subscription, Defender for Cloud automatically registers the Microsoft.ContainerService resource provider and deploys a DaemonSet (the Defender sensor) on each AKS node to collect runtime security signals. This sensor uses eBPF technology for kernel-level monitoring without modifying the node's operating system, enabling threat detection for host-level and container-level activities. In a real-world scenario, if the plan is not enabled, the cluster remains unprotected even if other Defender plans are active, leading to blind spots for container threats.
KKey Concepts to Remember
Defender for Containers is enabled at the subscription level in Defender for Cloud.
It provides agentless monitoring and protection for AKS clusters.
Enabling the plan automatically provisions necessary security components to AKS.
Defender for Containers integrates with Azure Policy for Kubernetes for enforcement.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Defender for Containers is enabled at the subscription level in Defender for Cloud.
Real-world example
How this comes up in practice
A cloud solutions architect for a retail company is evaluating services for a new workload. The correct answer here reflects best practice for the specific scenario described — not a general cloud recommendation. Defender for Containers is enabled at the subscription level in Defender for Cloud. Cloud exam questions reward reading the constraint carefully: the same technology can be right or wrong depending on the use case.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this SC-200 question in full detail.
Review defender for Containers is enabled at the subscription level in Defender for Cloud., then practise related SC-200 questions on the same topic to reinforce the concept.
Mitigate threats using Microsoft Defender for Cloud — This question tests Mitigate threats using Microsoft Defender for Cloud — Defender for Containers is enabled at the subscription level in Defender for Cloud..
What is the correct answer to this question?
The correct answer is: Enable the Defender for Containers plan for the subscription in Defender for Cloud. — Defender for Containers is a plan-level feature in Microsoft Defender for Cloud that must be enabled at the subscription level. Once enabled, it automatically discovers and protects AKS clusters without requiring any manual agent installation on nodes, as it uses the Defender sensor deployed by AKS itself. This is the only action needed to enable protection for the new AKS cluster.
What should I do if I get this SC-200 question wrong?
Review defender for Containers is enabled at the subscription level in Defender for Cloud., then practise related SC-200 questions on the same topic to reinforce the concept.
What is the key concept behind this question?
Defender for Containers is enabled at the subscription level in Defender for Cloud.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.