SC-200 Certification Practice Question #80

Question

You have an Azure subscription that has Microsoft Defender for Cloud enabled.

You have a virtual machine that runs Windows 10 and has the Log Analytics agent installed.

You need to simulate an attack on the virtual machine that will generate an alert.

What should you do first?

Accepted Answer

The question asks what to do **first** to simulate an attack that generates an alert on a Windows VM that already has the agent installed. The documented validation flow stages a benign executable and renames it to the known test pattern (ASC_AlertTest_662jfi039N.exe), then runs it with an argument so Defender for Cloud detects the simulated attack and raises an alert. Suggested Answer and Most Voted both land on B, and the top-voted explanatory comments (Comicbookman, Holii) cite the exact procedure and rule out re-running setup. Confidence is at 86 rather than higher because MS Learn's current page has shifted the documented Windows method to the PowerShell download-and-execute script, but the staged-executable step B is still the correct first action and the only viable option offered.

More SC-200 practice questions