SC-200 Practice Question: A security administrator wants to enable…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Assign Azure Policy to enable Defender for Cloud plans on the subscription

  Why it's wrong here

  Azure Policy can automate the rollout of Defender for Cloud plans by assigning the built-in initiative, but this is a deployment and enforcement mechanism, not the initial action. To actually enable Microsoft Defender for Cloud on a subscription, you must directly turn on enhanced security features (Standard tier) under the subscription's Defender for Cloud settings. Policy assignment alone does not activate the plan if the subscription has not been onboarded or if the resource provider is not registered.

• ✓

  Enable enhanced security features on the subscription

  Why this is correct

  Enabling enhanced security features on the subscription is the minimum configuration required to activate Microsoft Defender for Cloud and start receiving security alerts. This action, performed in the Defender for Cloud environment settings, moves the subscription from the free basic tier to the Standard tier, enabling threat detection and vulnerability assessments across all supported resource types. Without this direct enablement, no security alerts or advanced protections are available, regardless of other configurations.

• ✗

  Install the Azure Monitor Agent on all virtual machines in the subscription

  Why it's wrong here

  The Azure Monitor Agent (AMA) is an optional data collection agent that supports advanced audit capabilities such as file integrity monitoring and endpoint detection and response, but it is not required for Defender for Cloud's core alert generation. Many platform-level detections, such as those for storage accounts or SQL servers, rely on resource telemetry that does not require any agent. Installing AMA on all VMs is a supplementary hardening step, not a prerequisite for enabling Defender for Cloud on the subscription.

• ✗

  Enable Microsoft Defender for Cloud at the management group level only

  Why it's wrong here

  Enabling Defender for Cloud at the management group level is a scalable approach that propagates settings to child subscriptions, but it does not replace the need to explicitly enable enhanced security features on each subscription. A subscription outside the management group scope, or one that has inherited a 'Free' policy, may remain unsecured. Therefore, the minimum, guaranteed action for all Azure subscriptions is to enable enhanced security features directly on each subscription.