SC-200 Certification Practice Question #191

Question

You have an Azure subscription that uses Microsoft Defender for Cloud.

You need to configure Defender for Cloud to mitigate the following risks:

•	Vulnerabilities within the application source code
•	Exploitation toolkits in declarative templates
•	Operations from malicious IP addresses
•	Exposed secrets

Which two Defender for Cloud services should you use? Each correct answer presents part of the solution.

NOTE: Each correct answer is worth one point.

Accepted Answer

The four risks split cleanly across two plans. Defender for DevOps (E) is the only plan that scans application **source code** and **declarative IaC templates** and surfaces **exposed secrets** in repos ("secure Infrastructure as Code (IaC) templates," findings from "code, secrets, and dependency vulnerability scans"). Defender for Resource Manager (A) covers the management-plane risks — **operations from malicious IP addresses** and **use of exploitation toolkits** (MicroBurst/PowerZure), and its ARM alerts include exfiltration of Key Vault secrets. The official Suggested Answer lists only E, which is incomplete for a two-answer question; the 23-👍 highly-voted explanation and the 11-vote community consensus both add A, and MS Learn corroborates each mapping. Confidence is held at 90 (not higher) because the Suggested Answer is partial, but MS Learn resolves the gap decisively in favor of A+E.

More SC-200 practice questions