SC-200 Certification Practice Question #56

Question

You create a new Azure subscription and start collecting logs for Azure Monitor.
You need to configure Azure Security Center to detect possible threats related to sign-ins from suspicious IP addresses to Azure virtual machines. The solution must validate the configuration.
Which three actions should you perform in a sequence? To answer, move the appropriate actions from the list of action to the answer area and arrange them in the correct order.
Select and Place:

Accepted Answer

The task is to set up Defender for Cloud (Azure Defender) threat detection for suspicious-IP sign-ins to VMs and then validate the configuration. Validation must come after enablement, so Defender must be enabled on the subscription first. The validation itself uses the documented sample-alert technique: place a benign executable named with the ASC_AlertTest signature on the VM (ASC_AlertTest_662jfi039N.exe) and run it with the appropriate arguments, which triggers a sample security alert and proves end-to-end detection works. MS Learn's alert-validation guidance confirms the pattern of running a benign test executable on the VM to generate a Defender for Cloud alert. The "email severity threshold" tiles relate only to notification routing, and the "AlertTest.exe" tile drops the required ASC_AlertTest prefix, so all three are distractors. The official answer plus a 17 👍 "correct answer given" and the 9 👍 "only one possible" comment make the sequence highly reliable; confidence is held at 86 rather than higher because the validation procedure has since been updated (now PowerShell-based, per asquante's note) and the image's tile-to-slot mapping must be inferred rather than read from an answer image.

More SC-200 practice questions