SC-200 Manage a security operations environment Practice Question
Your organization uses Microsoft Defender for Cloud and you need to ensure that security recommendations are automatically remediated for non-compliant resources. You have enabled 'Auto provisioning' for the Log Analytics agent. What additional step is required to enable automatic remediation?
⚠ Common exam trap
Many candidates confuse 'Auto provisioning' (which only deploys the Log Analytics agent) with automatic remediation of all security recommendations, leading them to incorrectly select Option A.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable the 'DeployIfNotExists' policy for specific recommendations
Enabling 'Auto provisioning' for the Log Analytics agent only ensures the agent is installed on VMs, but does not automatically remediate security recommendations. To achieve automatic remediation, you must enable the 'DeployIfNotExists' effect on specific Azure Policy definitions (e.g., 'System updates should be installed on your machines'), which triggers remediation tasks when resources are non-compliant. This is a separate step in Defender for Cloud's 'Security policy' blade under 'Settings & monitoring'.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
No additional step is required; auto provisioning automatically remediates
Why it's wrong here
Auto provisioning in Defender for Cloud only deploys the Log Analytics agent (or Azure Monitor Agent) to collect security data; it has no effect on a resource's actual configuration or compliance state. It cannot repair misconfigured settings or install missing security controls, so a non-compliant VM remains non-compliant. Therefore, an explicit policy-based or manual remediation step is still required.
- ✗
Configure manual remediation in Defender for Cloud
Why it's wrong here
Manual remediation in Defender for Cloud is a one-time, human-executed action available from a recommendation's 'Remediate' button; it does not scale to many resources and does not enforce compliance over time. Once a resource is fixed manually, nothing prevents it from drifting back into a non-compliant state. It is a fallback, not the automated, continuous remediation that DeployIfNotExists policies provide.
- ✓
Enable the 'DeployIfNotExists' policy for specific recommendations
Why this is correct
The DeployIfNotExists policy effect is the correct method because it automatically deploys a required configuration or resource when Azure Policy evaluates a resource as non-compliant. When you assign such a policy for a specific Defender for Cloud recommendation, it performs the remediation task on the spot and continuously in subsequent evaluations. This makes it the only automated approach listed that actually fixes the underlying issue.
- ✗
Create a custom Azure Policy initiative with audit effect
Why it's wrong here
A custom Azure Policy initiative using the Audit effect only records whether a resource conforms to the policy condition; it produces compliance data but never alters the resource. Because Audit does not apply any changes, it cannot remediate the non-compliant resource by itself. To achieve automatic remediation, you need an effect like DeployIfNotExists or Modify within the initiative.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SC-200 question from scratch — 1,303 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.