SC-200 Certification Practice Question #81

Question

You create a new Azure subscription and start collecting logs for Azure Monitor.

You need to validate that Microsoft Defender for Cloud will trigger an alert when a malicious file is present on an Azure virtual machine running Windows Server.

Which three actions should you perform in a sequence? To answer, move the appropriate actions from the list of action to the answer area and arrange them in the correct order.

NOTE: More than one order of answer choices is correct. You will receive credit for any of the correct orders you select.

Accepted Answer

To validate that Defender for Cloud raises an alert for a malicious file, you must first ensure the protection plan is active (enable enhanced security features — tile 6), then stage the malware-test signal by copying an executable and renaming it to the documented test pattern ASC_AlertTest_662jfi039N.exe (tile 2), then execute it with the appropriate arguments so the detection fires (tile 4). MS Learn's alert-validation guidance follows this same enable-then-stage-then-run pattern. The community is unanimous on 6-2-4 (35 and 14 👍 with no meaningful dissent), and the email-severity tiles and the wrong-filename tile are clearly distractors. Confidence is 88 (a confidently resolved DRAG DROP) rather than higher because there is no official Suggested Answer recorded and the question itself notes more than one order can be credited.

More SC-200 practice questions