SC-200 Practice Question: Arrange the steps to deploy Microsoft Defender…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Step 1: Add an app connector for the cloud app. Step 2: Authenticate the connector. Step 3: Enable monitoring and policies.

  Why this is correct

  Adding the app connector first creates the integration object in Defender for Cloud Apps that points to the cloud app's API endpoint. Authenticating the connector then completes the OAuth or credential flow, granting Defender for Cloud Apps the permissions needed to read logs and activities. Only after authentication can monitoring and policies be enabled, because they consume the authorized data stream supplied by the connector.

• ✗

  Step 1: Enable monitoring and policies. Step 2: Add an app connector. Step 3: Authenticate the connector.

  Why it's wrong here

  Attempting to enable monitoring and policies at step one is logically impossible because there is no data source yet — the connector that would pull activity logs and user events has not been created. Monitoring features such as anomaly detection and policy enforcement rely entirely on data flowing from an authenticated connector; without it, they have nothing to inspect. The connector must be added and authenticated before monitoring can be toggled on, so this order fails.

• ✗

  Step 1: Authenticate the connector. Step 2: Add an app connector. Step 3: Enable monitoring and policies.

  Why it's wrong here

  You cannot authenticate a connector before the connector exists, because authentication is performed against the specific connector instance added for a given cloud app. In the Defender for Cloud Apps portal, the first action is to select 'Connect an app' from the App connectors page, which creates that instance; only then does the portal present the authentication/consent screen. Authenticating first would leave the returned OAuth tokens with nothing to attach to, making the step meaningless.

• ✗

  Step 1: Add an app connector. Step 2: Enable monitoring and policies. Step 3: Authenticate the connector.

  Why it's wrong here

  This sequence includes the fatal flaw of enabling monitoring and policies before the connector is authenticated, so the connector lacks permissions to query the cloud app's APIs and deliver activity data. Adding the connector first is correct, but skipping authentication means the monitoring engine is switched on while the data pipeline remains empty, and policies would never evaluate any real events. You must authenticate immediately after adding the connector and before enabling monitoring so that authorization is in place to collect data.

Go deeper

Related to this question