SC-200 Practice Question: A security operations team has Microsoft Defender…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  In Microsoft Sentinel, add the 'Microsoft Defender for Cloud' data connector and select the subscriptions to stream alerts and recommendations.

  Why this is correct

  The Microsoft Defender for Cloud data connector in Microsoft Sentinel is the native integration path for streaming cloud security alerts and recommendations. When you add this connector and select your subscriptions, Sentinel automatically ingests the data into the SecurityAlert and SecurityRecommendation tables using the correct schema and entity mapping. This creates a direct, managed pipeline that allows the SOC to triage and respond to Defender for Cloud findings as Sentinel incidents without any additional configuration.

• ✗

  In Microsoft Defender for Cloud, create a continuous export to a Log Analytics workspace that is already connected to Sentinel.

  Why it's wrong here

  Continuous export in Defender for Cloud can send raw security alerts and recommendations to a Log Analytics workspace, but this is intended for long-term retention and custom analytics, not for directly operationalizing Sentinel incidents. When you use continuous export, Sentinel does not automatically generate incidents or apply the connector's built-in entity mapping; you would have to build your own analytics rules and normalize the data. The Sentinel data connector is the recommended, simpler method because it handles the correct schema, entity mapping, and ingestion natively.

• ✗

  Create an Azure Policy that deploys Azure Monitor Agent to all VMs and configures data collection rules to send data to Sentinel.

  Why it's wrong here

  Deploying Azure Monitor Agent to all VMs via Azure Policy and configuring data collection rules sends operating system and application telemetry such as Syslog, Windows Event Logs, and performance counters to a Log Analytics workspace. This approach does not capture Defender for Cloud's security alerts or recommendations, which are generated by the cloud security posture management and workload protection at the subscription level. Defender for Cloud findings are not VM guest data and therefore cannot be collected by Azure Monitor Agent; they are accessed through the Defender for Cloud APIs or the Sentinel connector.

• ✗

  Enable the 'Enable integration with Microsoft Sentinel' option in the Defender for Cloud pricing & settings blade.

  Why it's wrong here

  There is no 'Enable integration with Microsoft Sentinel' option in the Defender for Cloud pricing & settings blade; the pricing & settings page is used to configure Defender plans, monitoring coverage, and data collection settings for connected resources. The integration between Defender for Cloud and Sentinel is initiated from Microsoft Sentinel's data connectors page, not from Defender for Cloud. Attempting to find such an option would result in failure, and any 'integration' from the Defender side is limited to exporting logs via diagnostic settings, not a direct one-click connection.

Go deeper

Related to this question