SC-200 Practice Question: A large organization manages multiple Azure…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Assign the Azure Policy initiative 'Configure Azure Defender to be enabled on subscriptions' to the management group with appropriate policy parameters.

  Why this is correct

  This built-in policy initiative uses DeployIfNotExists effects to enable Microsoft Defender for Cloud plans across all subscriptions within the management group's hierarchy. Because Azure Policy assignments are inherited and continuously evaluated, any subscription added later automatically receives the Defender plans without manual intervention. Assigning parameters lets you control which plans (e.g., SQL, Storage, Key Vault) are enabled, while the policy's remediation task ensures existing non-compliant subscriptions are brought into compliance.

• ✗

  Enable all Microsoft Defender plans at the management group level in the Microsoft Defender for Cloud portal.

  Why it's wrong here

  Using the portal's environment settings to toggle Defender plans on at the management group scope only applies the configuration to subscriptions currently present in that hierarchy. When a new subscription is created, it does not inherit those portal-level plan settings, so it remains unprotected until someone enables the plans again. The portal toggle is a one-time operation, not a continuous governance mechanism, so it fails to meet the automatic compliance requirement.

• ✗

  Manually enable the Defender plans on each new subscription as they are created.

  Why it's wrong here

  Manually enabling Defender plans as each new subscription is created is operationally brittle and depends on an engineer remembering the steps every time. There is no enforcement layer, so a missed subscription would silently remain without security coverage, and audit evidence of when and how plans were enabled would be unreliable. Manual toggling also cannot scale across a large multi-subscription environment or provide the steady-state compliance that Azure Policy delivers.

• ✗

  Use an Azure Blueprint to assign the Defender plans to the subscription.

  Why it's wrong here

  Azure Blueprints are designed for deploying and consistently applying a defined set of resources, policies, and role assignments to subscriptions, typically during initial provisioning or for establishing a baseline. They do not, however, provide the reactive, continuous mechanism required to automatically enable Defender for Cloud plans on *new subscriptions added to an existing management group* after the blueprint's initial assignment. Blueprints are excellent for enforcing a compliant environment at the point of subscription creation or when applying a template, ensuring initial setup includes specific Defender policy assignments.