SC-200 Certification Practice Question #27

Question

You have an Azure subscription that contains the users shown in the following table.

You need to delegate the following tasks:

•	Enable Microsoft Defender for Servers on virtual machines.
•	Review security recommendations and enable server vulnerability scans.

The solution must use the principle of least privilege.

Which user should perform each task? To answer, drag the appropriate users to the correct tasks. Each user may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.

NOTE: Each correct selection is worth one point.

Accepted Answer

Both tasks are configuration actions, which immediately eliminates User2 (Security Reader is strictly read-only). The decisive row is Task 2: enabling server vulnerability scans is done by applying a security recommendation ("Fix"), and the MS Learn roles table shows Security Admin is explicitly NOT permitted to apply recommendation Fixes (✗) while Contributor is (✔) — so Task 2 must be User3. For Task 1, both Security Admin and Contributor can enable a Defender plan; under least privilege the answer key follows the same Contributor (User3) that the highest-voted reasoned comments (danlo 14, mb0812 9+4) converge on, also noting "Security administrator" here is the Defender-for-Cloud RBAC concept being tested against the Azure RBAC table. Confidence is held at 77% because there is a genuine community split: the single most-upvoted comment (wsrudmen, 33) argues User1/User1, the Suggested Answer is absent, and a real-exam read of "Security administrator" as a portal role rather than the DfC RBAC role could push Task 1 toward User1. MS Learn breaks the tie toward User3/User3 via the recommendation-Fix and least-privilege rules.

More SC-200 practice questions