SC-200 Certification Practice Question #82

Question

You have an Azure subscription that uses Microsoft Defender for Cloud and contains 100 virtual machines that run Windows Server.

You need to configure Defender for Cloud to collect event data from the virtual machines. The solution must minimize administrative effort and costs.

Which two actions should you perform? Each correct answer presents part of the solution.

NOTE: Each correct selection is worth one point.

Accepted Answer

The question asks for two actions that let Defender for Cloud collect event data from 100 Windows Server VMs with minimal effort and cost. Enabling auto-provisioning (E) makes Defender for Cloud automatically deploy the monitoring agent to every VM, eliminating per-machine manual installation — the official Suggested answer and confirmed by MS Learn's data-collection guidance. To minimize cost, the workspace's security-event collection level is set to Common rather than All Events (A vs D): Common keeps the essential security events while All Events ingests (and bills for) everything. The community is dominantly AE (35 votes; 21-👍 top comment), and the BE minority fails because Intune/Endpoint Manager is for endpoint device management, not Windows Server VM data collection in Defender for Cloud, and would add administrative effort rather than reduce it.

More SC-200 practice questions