mediumMultiple ChoiceObjective-mapped
SC-200 Practice Question: A company has enabled Microsoft Defender for…
A company has enabled Microsoft Defender for Cloud on their subscription containing Azure SQL databases. They receive an alert about a potential SQL injection attack. The analyst wants to see the actual query that was executed. Where can the analyst find the query details associated with the alert?
⚠ Common exam trap
Many candidates confuse the Azure Activity Log (control-plane) with data-plane logs, or assume that threat detection logs are the primary source for query details, when in fact the alert's entity tab is the direct, curated source for the executed query.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
In the alert's entity tab
When Microsoft Defender for Cloud detects a SQL injection attack, the alert details include an 'Entities' tab that contains the actual SQL query that was executed. This tab provides the raw query text, which is essential for the analyst to understand the exact payload used in the attack and to assess the impact on the database.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
In the alert's entity tab
Why this is correct
The entity tab on a Microsoft Defender for Cloud alert details page provides a curated, contextual view of all affected resources and associated security entities. For SQL alerts, this includes the exact SQL query text that triggered the detection, along with related details such as the user account, source IP, and database. This is the designed interface to locate the flagged query, as it is directly tied to the alert's investigation workflow.
- ✗
By opening the SQL database's threat detection logs
Why it's wrong here
While SQL database threat detection relies on underlying audit logs and telemetry, the Defender for Cloud alert does not redirect you to those raw logs. Opening the database's threat detection logs would require manually navigating through Log Analytics or SQL auditing settings, and these logs often lack the alert-specific entity context. The query is not presented there in a directly consumable manner for the specific alert, making this an inefficient and indirect path.
- ✗
In the Azure Activity Log
Why it's wrong here
The Azure Activity Log is a control-plane log that records resource management operations such as creating, modifying, or deleting Azure resources. It does not capture data-plane events like SQL query execution, which occur inside the database workload. Therefore, seeking the flagged SQL query in the Activity Log would show only resource-level audit events, never the actual query text associated with the alert.
- ✗
In the alert's diagnostic data
Why it's wrong here
Diagnostic data within an alert may contain raw, unstructured event payloads that contribute to the detection, but it is not the authoritative location for viewing the SQL query. The entity tab explicitly organizes and presents the query alongside other relevant entities for investigation, whereas diagnostic data is more technical and may require additional parsing. Microsoft Defender for Cloud intentionally surfaces the query in the entity tab, so relying on diagnostic data would add unnecessary complexity and obscure the finding.
Go deeper
Related to this question
About these practice questions
This SC-200 question is part of Courseiva's 209-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.