easyMultiple Choice
SC-200 Practice Question: Your organization has multiple Azure…
Your organization has multiple Azure subscriptions and wants to ensure that all of them have Microsoft Defender for Cloud's enhanced security features enabled. What is the minimal step required to achieve this for all subscriptions?
⚠ Common exam trap
It's easy for candidates to confuse enabling Defender for Cloud plans with deploying agents or configuring policies, but the minimal step is simply toggling the plans at the management group scope, which applies to all child subscriptions automatically.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable the required Defender for Cloud plans at the management group level
Enabling Microsoft Defender for Cloud plans at the management group level is the minimal step because it applies the configuration to all child subscriptions under that management group in a single action. This leverages Azure's hierarchical management structure, ensuring every subscription inherits the enhanced security features without needing individual subscription-level configuration.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Assign an Azure Policy initiative to enable Defender for Cloud on each subscription
Why it's wrong here
Assigning an Azure Policy initiative, such as 'Configure Microsoft Defender for Cloud plans to be enabled', can enforce plan enablement across subscriptions, but it introduces policy assignment and potential remediation overhead. This is not the minimal step because Defender for Cloud's native enablement at management group scope achieves the same result directly, without requiring a policy object, initiative, or compliance monitoring to be provisioned and maintained.
- ✓
Enable the required Defender for Cloud plans at the management group level
Why this is correct
Enabling the required Defender for Cloud plans at the management group level propagates the pricing-tier settings to every subscription nested beneath that management group. Because Defender for Cloud plan configuration is inherited hierarchically, this single action provisions the plans across all subscriptions at once, eliminating the need to navigate to each subscription individually. This is the simplest and most direct method for multi-subscription enablement.
- ✗
Install the Log Analytics agent on all virtual machines in each subscription
Why it's wrong here
Installing the Log Analytics agent on virtual machines collects guest-level telemetry and is required for certain Defender for Cloud features, such as file integrity monitoring, endpoint detection, and adaptive application controls. However, the core plans, such as CSPM, servers, and SQL, are enabled at the subscription or management group level via the pricing settings; the agent is not a prerequisite for enabling those plans. Moreover, Defender for Cloud can use agentless collection options for some workloads, further decoupling plan enablement from agent deployment.
- ✗
Create a security contact email for each subscription
Why it's wrong here
Creating a security contact email address configures where Microsoft sends alert notifications, attack path summaries, and recommendation digests from Defender for Cloud. This is a subscription-level notification setting, not an enablement control; it does not toggle any Defender plan from Off/Free to On/Standard. Security contacts are purely operational, and failing to configure them leaves the plans enabled but alerts undelivered, demonstrating they are unrelated to the minimal enabling step.
Go deeper
Related to this question
About these practice questions
One of 1,303 original SC-200 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.