Microsoft Security Operations Analyst Associate SC-200 Practice Question

For Azure VMs protected by Defender for Servers Plan 2, Microsoft Defender for Cloud automatically integrates with Microsoft Defender for Endpoint (MDE). When you choose the Investigate in Microsoft Defender for Endpoint action from the alert page, Defender for Cloud opens the corresponding incident in MDE, where the device timeline and process tree reveal the executable that triggered the network call. From the same portal you can then block or quarantine the offending process. The other options either export data without providing process-level insight (CSV download), initiate an automated response without first identifying the executable (Logic App), or display resource inventory data that does not expose per-process activity (Resource Graph Explorer).