SC-200 Certification Practice Question #75

Question

You have an Azure subscription that uses Microsoft Defender for Cloud.

You need to filter the security alerts view to show the following alerts:

•	Unusual user accessed a key vault
•	Log on from an unusual location
•	Impossible travel activity

Which severity should you use?

Accepted Answer

The question asks which single severity filter returns all three listed alerts. Per the Defender for Cloud alerts reference, "Unusual user accessed a key vault" is classified Medium, and the identity-protection alerts "Log on from an unusual location" and "Impossible travel activity" are anomalous-behavior detections in the Medium band (suspicious activity that might indicate compromise, not a confirmed active attack). Both the Suggested Answer and a dominant 24-vote majority select C, and the High-severity argument is a misreading — High is reserved for confirmed/active attacks, so filtering by High would not surface these anomaly alerts. This puts the answer firmly at Medium.

More SC-200 practice questions