SC-200 Practice Question: A company has multiple Azure subscriptions under…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Assign the 'Azure Security Benchmark' initiative at the management group, enable automatic remediation for the 'Vulnerability assessment should be enabled on your virtual machines' policy.

  Why it's wrong here

  The Azure Security Benchmark built-in initiative contains the policy 'Vulnerability assessment should be enabled on your virtual machines' with only an Audit effect. Audit-effect policies report non-compliance but cannot deploy anything, so toggling automatic remediation on that assignment is ineffective because Azure Policy requires a DeployIfNotExists or Modify effect to execute remediation tasks. This option therefore gives visibility only, not installation, and would force a manual or separate remediation path.

• ✗

  Assign the 'Defender for Cloud' initiative with the 'Configure machines to receive a vulnerability assessment provider' policy, and configure a remediation task with a deployment script.

  Why it's wrong here

  Although 'Configure machines to receive a vulnerability assessment provider' is indeed the correct DeployIfNotExists policy, the 'Defender for Cloud' initiative is a broad grouping of security recommendations, not a deployment mechanism. Wrapping this DINE policy in a remediation task that runs a custom deployment script is unnecessary and introduces drift: Azure Policy can already create remediation tasks that apply the deployment template natively at evaluation time. Adding a scripted automation layer outside the policy lifecycle creates extra permissions, failure points, and timing gaps that the native DINE mechanism avoids.

• ✗

  Assign the 'Azure Security Benchmark' initiative and create an Azure Automation runbook triggered by a compliance alert to enable VA.

  Why it's wrong here

  The Azure Security Benchmark is a collection of security recommendations rather than a policy initiative designed to enforce specific resource configurations like the Microsoft Defender Vulnerability Management engine. This approach fails because it lacks the native remediation capabilities required by the stem. Using an Automation runbook triggered by alerts introduces latency and management overhead that built-in 'DeployIfNotExists' policies avoid. You would use this combination when performing custom orchestration across heterogeneous environments outside of standard Azure Policy lifecycle management.

• ✓

  Assign the 'Configure machines to receive a vulnerability assessment provider' policy with 'DeployIfNotExists' effect and set it to auto-remediate at the management group-level scope.

  Why this is correct

  The built-in DeployIfNotExists policy 'Configure machines to receive a vulnerability assessment provider' automatically installs the vulnerability assessment agent/extension on any virtual machine that does not have it. Assigning this policy at the management group scope makes the effect apply to every subscription and VM under that group, and enabling the remediation task in the assignment ensures existing non-compliant VMs are also remediated, not just new ones. This approach couples detection with deployment, which is the key difference from audit-only options, and it uses the standard Azure Policy lifecycle without custom scripts or runbooks.

Go deeper

Related to this question