Question 762 of 209
mediumMultiple ChoiceObjective-mapped
SC-200 Practice Question: A large enterprise uses Microsoft Defender for…
A large enterprise uses Microsoft Defender for Cloud with all enhanced security plans (e.g., Defender for Servers, Defender for SQL) enabled on a management group. The security team wants to automatically enable these plans on new Azure subscriptions that are created under this management group. Which approach is the most efficient and scalable?
⚠ Common exam trap
Watch out — candidates often confuse Azure Blueprints (which apply settings only at deployment time) with Azure Policy (which provides continuous enforcement and automatic remediation), leading them to choose the Blueprints option despite its lack of ongoing compliance and scalability for new subscriptions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use an Azure Policy definition that enforces the Microsoft Defender for Cloud pricing tier (Standard) at the management group scope.
Azure Policy can be assigned at the management group scope to enforce the 'Standard' pricing tier for Microsoft Defender for Cloud on all current and future subscriptions. This ensures that when a new subscription is created under that management group, the policy automatically evaluates and remediates the subscription to enable the required Defender plans, providing a fully automated, scalable, and governance-driven approach without manual intervention or custom scripting.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use an Azure Policy definition that enforces the Microsoft Defender for Cloud pricing tier (Standard) at the management group scope.
Why this is correct
Azure Policy's built-in 'Configure Microsoft Defender for Cloud plans to be enabled' definition, assigned at the management group, uses the DeployIfNotExists effect to update the pricing tier of every subscription under that scope. Because policy inheritance is evaluated continuously, any subscription created later is non-compliant until remediated, and the policy engine will automatically enable the Defender plans without human intervention. This provides declarative, continuous enforcement that scales across the entire enterprise.
- ✗
Manually enable the plans for each new subscription when it is created.
Why it's wrong here
Relying on manual enablement requires an administrator to remember and act on each new subscription immediately after its creation, which is not scalable for a large enterprise with frequent provisioning. The process introduces human error, latency in security coverage, and produces no systematic audit trail or enforcement mechanism, so a missed step leaves a subscription unprotected. Unlike policy-based governance, manual action has no ongoing compliance checking and does not scale consistently.
- ✗
Create an Azure Automation runbook that runs on a schedule and enables plans for all subscriptions under the management group.
Why it's wrong here
A scheduled Automation runbook is reactive and non-declarative: it must be triggered by an external timer or event, and if the runbook fails, lacks proper managed identity permissions, or runs before a new subscription's resource provider is ready, the Defender plans will not be enabled and there is no automatic retry or compliance signal. The runbook's code and schedule also become ongoing maintenance burden, and it cannot guarantee that a subscription created between runs is covered immediately. In contrast, an Azure Policy assignment continuously evaluates all subscriptions in the management group and enforces the desired state without a maintenance window.
- ✗
Use Azure Blueprints to define the Defender for Cloud settings in the blueprint definition.
Why it's wrong here
Azure Blueprints can define Defender for Cloud settings per subscription, but they require manual assignment or a deployment pipeline for each new subscription, lacking automatic inheritance from the management group. This fails the stem’s requirement for automatic enablement on newly created subscriptions. It is tempting because Blueprints are designed to enforce consistent configurations across subscriptions at scale, and would be correct if the goal were to apply a custom, auditable set of policies to existing subscriptions via a controlled deployment process.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SC-200
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A large enterprise uses Microsoft Defender for Cloud with all enhanced security plans enabled. They want to automatically enable the Defender for Cloud plans on new Azure subscriptions that are created under their management group. Which approach should they use?
medium- ✓ A.Assign the built-in Azure Policy initiative 'Enable Microsoft Defender for Cloud on all subscriptions' at the management group level.
- B.Configure 'Continuous export' settings in Defender for Cloud to export policies to Log Analytics for each subscription.
- C.Set the default security policies at the management group level in Defender for Cloud's environment settings.
- D.Enable 'Auto provisioning' for the Log Analytics agent in Defender for Cloud.
Why A: The built-in Azure Policy initiative 'Enable Microsoft Defender for Cloud on all subscriptions' is designed to be assigned at a management group scope, automatically enabling all Defender for Cloud plans on new subscriptions as they are created under that management group. This leverages Azure Policy's compliance evaluation and remediation tasks to enforce the security plans across the entire hierarchy without manual intervention.
Last reviewed: Jun 11, 2026
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.