mediumMultiple ChoiceObjective-mapped
SC-200 Practice Question: A security analyst in Microsoft Defender for…
A security analyst in Microsoft Defender for Cloud receives an alert that an Azure VM has a vulnerability with a high severity. The analyst wants to see the detailed finding, including the steps to remediate. Which blade or page should the analyst open?
⚠ Common exam trap
A common mix-up: candidates confuse the 'Workload protections alerts' blade (which shows active threat detections) with the 'Vulnerability Assessment findings' blade (which shows scan results), leading them to select D instead of A.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Vulnerability Assessment findings
The Vulnerability Assessment findings blade in Microsoft Defender for Cloud displays detailed results from integrated vulnerability scanners (such as Qualys or Microsoft Defender Vulnerability Management), including the specific vulnerability ID, severity, description, and remediation steps. This is the correct location to view the detailed finding and remediation guidance for a high-severity vulnerability on an Azure VM.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Vulnerability Assessment findings
Why this is correct
The Vulnerability Assessment findings blade in Microsoft Defender for Cloud is the dedicated destination for aggregated scan results from integrated vulnerability assessment solutions, such as Microsoft Defender Vulnerability Management or Qualys, across Azure VMs, hybrid machines, and container images. It lists each discovered CVE with its severity, affected resource, and step-by-step remediation guidance, so an analyst investigating a specific vulnerability finding would open this blade to view and act on the detailed results.
- ✗
Secure Score
Why it's wrong here
Secure Score in Defender for Cloud provides a percentage-based measure of an organization's overall security posture by calculating how many controls have been improved through recommendations, but it does not expose individual vulnerability findings with CVE IDs, affected resources, or patch instructions. While a vulnerability finding might indirectly influence the score via associated recommendations, the Secure Score blade only shows the score breakdown and control status, not the detailed vulnerability data an analyst needs for a specific finding.
- ✗
Regulatory Compliance
Why it's wrong here
The Regulatory Compliance blade in Defender for Cloud evaluates Azure subscription and resource configurations against predefined industry standards, such as CIS, ISO 27001, or the Azure Security Benchmark, and displays compliance posture through passed and failed controls. It does not ingest or surface raw vulnerability scan results; a specific vulnerability finding with CVE-level detail and remediation guidance would not appear here because this blade is concerned with mapping compliance requirements to recommendation assessments, not with presenting vulnerability scanner output.
- ✗
Workload protections alerts
Why it's wrong here
Workload protections alerts, formerly known as Azure Defender alerts, are security alerts generated by threat detection logic—such as suspicious sign-ins, malware execution, or network reconnaissance—and contain alert metadata like tactics, entities, and related threat intelligence. A vulnerability assessment finding is not a threat detection alert; it is the result of an active scan identifying known weaknesses, so the workload protections alerts blade would not show CVE details, vulnerability severity, or remediation steps that belong to the Vulnerability Assessment findings view.
Go deeper
Related to this question
About these practice questions
One of 673 original SC-200 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.