SC-200 Practice Question: Enable Microsoft Defender for Cloud's enhanced…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Turn on the 'Servers' plan for the subscription

  Why this is correct

  Enabling the 'Servers' plan at the subscription level is the authoritative first step that activates Microsoft Defender for Cloud's enhanced security features (formerly Azure Defender) for every supported VM in that subscription. This plan turns on capabilities such as threat detection, just-in-time VM access, and integrated vulnerability assessment, making it the required prerequisite before any other configuration or agent deployment can deliver full value. Without this plan enabled, other settings remain dormant or incomplete.

• ✗

  Install the Log Analytics agent on each VM

  Why it's wrong here

  Although the Log Analytics agent (or Azure Monitor Agent) is essential for collecting security telemetry like event logs and inventory data, installing it on each VM does not by itself enable enhanced security features. In fact, the Servers plan often auto-provisions the agent during enablement, so manually installing it first is both premature and unnecessary. The agent is a data-collection mechanism, not the licensing or feature activation control for Defender for Cloud.

• ✗

  Enable vulnerability assessment

  Why it's wrong here

  Enabling vulnerability assessment—whether through the integrated Qualys solution or Microsoft Defender Vulnerability Management—is a discrete capability that becomes available only after the Servers plan is turned on. It cannot be independently activated to grant broader enhanced security features; rather, it is one subordinate component that the Servers plan encompasses. Attempting to enable it before the plan is active will fail or have no effect on the overall security posture.

• ✗

  Assign a regulatory compliance policy

  Why it's wrong here

  Assigning a regulatory compliance policy, such as a custom Azure Policy initiative for CIS or NIST, only configures compliance assessments and reporting in Defender for Cloud; it does not activate any enhanced security features. These policies rely on the underlying plan being enabled to assess certain security controls, but the assignment itself is a governance action, not a service activation. Thus, it is a separate post-enablement activity, not the prerequisite that turns on the plan's protections.

Go deeper

Related to this question