easyMultiple Choice
SC-200 Practice Question: A security administrator wants to ensure that all…
A security administrator wants to ensure that all Azure virtual machines have automatic provisioning of the Log Analytics agent enabled by default in Microsoft Defender for Cloud. Where should this configuration be set?
⚠ Common exam trap
Many exam-takers confuse the centralized 'Data collection' setting in Defender for Cloud with per-VM manual extension installation (Option A) or with Azure Policy assignments (Option D), not realizing that Defender for Cloud provides a built-in toggle to enable automatic provisioning across all VMs in a subscription.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
In Microsoft Defender for Cloud, under 'Environment settings' > 'Data collection'
The automatic provisioning of the Log Analytics agent for all Azure virtual machines in Defender for Cloud is configured under 'Environment settings' > 'Data collection'. This setting enables Defender for Cloud to automatically deploy the Log Analytics agent to new and existing VMs, ensuring security monitoring without manual intervention.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
In the Azure portal under each virtual machine's 'Extensions + applications' blade
Why it's wrong here
The 'Extensions + applications' blade in the Azure portal is for manually managing extensions on an individual VM, such as installing or removing the Log Analytics agent. This method does not scale across all subscriptions and does not configure Defender for Cloud's auto-provisioning, which is a central, policy-based setting that covers all existing and future VMs automatically.
- ✓
In Microsoft Defender for Cloud, under 'Environment settings' > 'Data collection'
Why this is correct
Microsoft Defender for Cloud's 'Environment settings' > 'Data collection' page is the correct central location to enable auto-provisioning of the Log Analytics agent (or Azure Monitor Agent) across all subscriptions. Toggling the agent here creates the underlying policy assignments that automatically install the agent on every VM without per-VM manual interaction, ensuring consistent security monitoring coverage.
- ✗
In Microsoft Sentinel, under 'Data connectors' for Defender for Cloud
Why it's wrong here
Microsoft Sentinel's 'Data connectors' page is for connecting data sources, like Microsoft Defender for Cloud, to the Sentinel workspace so that security logs can be queried and analyzed. This page only affects log ingestion and does not control agent installation or auto-provisioning on Azure VMs; any agent required must already be deployed upstream by Defender for Cloud or another method.
- ✗
In Azure Policy, by assigning the 'Deploy Log Analytics agent' initiative
Why it's wrong here
While the 'Deploy Log Analytics agent' policy initiative does exist and can be manually assigned in Azure Policy, this is not the intended administrative interface for configuring auto-provisioning in Defender for Cloud. Defender for Cloud creates and manages these policy assignments behind the scenes when you enable the agent under 'Data collection', so assigning the initiative separately can lead to duplicate or conflicting compliance efforts and bypasses Defender for Cloud's centralized monitoring settings.
Go deeper
Related to this question
About these practice questions
One of 1,303 original SC-200 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.