SC-200 Practice Question: A security administrator wants to ensure that all…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Continuous export of security findings to Log Analytics

  Why it's wrong here

  Continuous export is a data-streaming setting in Microsoft Defender for Cloud that forwards security alerts and recommendations—including vulnerability findings that were already collected—to a Log Analytics workspace. It enables downstream investigation, custom alert rules, and integration with SIEM tools such as Sentinel, but it does not install any vulnerability-assessment agent or extension on Azure VMs. Without auto-provisioning or manual installation, existing and future VMs will have no scanner producing findings, so this option does not satisfy the requirement to ensure all VMs have a vulnerability assessment solution.

• ✓

  Auto-provisioning of the vulnerability assessment solution

  Why this is correct

  Auto-provisioning in Microsoft Defender for Cloud is the correct mechanism because it automatically deploys the vulnerability-assessment solution—the integrated Microsoft Defender Vulnerability Management engine or the Qualys agent—to all existing virtual machines and applies an Azure Policy effect to any future VM at creation time. Once enabled at the subscription or management-group level, it removes the need for manual agent installation, ensures every new instance receives the scanner, and keeps the assessor running through the Azure Monitor Agent or Log Analytics agent as appropriate. This continuous, agent-based coverage is precisely what the requirement 'ensure that all existing and future Azure virtual machines have VA' demands.

• ✗

  Just-in-time VM access

  Why it's wrong here

  Just-in-time (JIT) VM access is a network security control that restricts inbound traffic to management ports (RDP, SSH, WinRM) until an authorized user requests temporary access, and then it automatically revokes those rules after a defined window. It directly reduces the attack surface by blocking brute-force login attempts, but it performs no scanning whatsoever for software vulnerabilities, misconfigurations, or missing patches. Since the goal is to enable a vulnerability assessment solution across all VMs, JIT access is an orthogonal defense-in-depth control and does not contribute any agent, scanner, or vulnerability data.

• ✗

  Regulatory compliance dashboard

  Why it's wrong here

  The regulatory compliance dashboard in Defender for Cloud is a visualization and reporting surface that maps the security posture of your resources—including any vulnerability-assessment findings the environment has already produced—against standards such as CIS, PCI DSS, and NIST. It aggregates and tracks compliance scores and gives you a view of passing and failing controls, but it is a read-only presentation layer. It cannot deploy the vulnerability-assessment solution, activate scanning, or install agents on existing or future VMs; at most, it would show that VA is absent if the evaluation engine is running.

Go deeper

Related to this question