SC-200 Certification Practice Question #225

Question

You have an Azure subscription that contains the users shown in the following table.

The subscription contains instances of Azure Firewall as shown in the following table.

You have a Microsoft 365 E5 subscription that uses Microsoft Copilot for Security. You have the Copilot for Security role assignments shown in the following table.

Each user runs a Copilot for Security session.

For each of the following statements, select Yes if the statement is true. Otherwise, select No.

NOTE: Each correct selection is worth one point.

Accepted Answer

MS Learn states two firm prerequisites for the Azure Firewall plugin in Security Copilot: (1) the firewall must emit **resource-specific structured IDPS logs sent to a Log Analytics workspace**, and (2) the user must have **appropriate Azure RBAC to access the firewall AND the associated Log Analytics workspace**. AFW1 uses unstructured logs (fails requirement 1) → Statement 1 = No. AFW2 has structured logs but sends them to **Event Hubs**, not Log Analytics, which Copilot queries (fails requirement 1) → Statement 2 = No. AFW3 satisfies the technical requirement, but User3 holds only **Security Reader** scoped to a resource group — a Defender-for-Cloud read role that does not grant Log Analytics workspace data access, and Copilot does not elevate permissions — so Statement 3 = No. This NNN reading aligns with the two best-reasoned, requirement-citing comments (Earthlinghex, f90c339). Confidence is held below 75 because the community is genuinely split: a comparably-voted "YNY" camp argues the Subscription Contributor/Owner roles confer the needed Log Analytics access (which would flip Statements 1 and 3), but those comments are largely ungrounded ("as per ChatGPT") and internally inconsistent (YNY vs YNN), and they overlook the structured-log/destination requirements that decisively fail AFW1 and AFW2 regardless of role.

More SC-200 practice questions