AZ-500 Manage identity and access Practice Question
A company uses Microsoft Defender for Cloud to manage the security posture of their Azure workloads. The compliance officer needs to generate a report that shows the current compliance status against the SOC 2 standard, including the pass/fail status of each control. Which feature in Defender for Cloud should they use?
⚠ Common exam trap
Test-takers frequently confuse the Secure Score (which measures overall security posture) with regulatory compliance reporting, not realizing that Secure Score does not map to specific standard controls like SOC 2.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Regulatory compliance dashboard
The Regulatory compliance dashboard in Microsoft Defender for Cloud provides a pre-built, continuously updated view of compliance posture against standards like SOC 2. It maps Azure Policy initiatives to specific controls and shows the pass/fail status for each control, enabling the compliance officer to generate the required report directly.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Regulatory compliance dashboard
Why this is correct
The Regulatory compliance dashboard is the built-in feature in Microsoft Defender for Cloud that provides a compliance posture view against chosen standards such as SOC 2 Type II. It maps Azure Policy initiative controls to the specific requirements of the standard, showing per-control status, affected resources, and actionable recommendations. This is the direct, purpose-built tool for reporting compliance with a regulatory standard like SOC 2, so it is correct.
- ✗
Inventory
Why it's wrong here
Inventory in Defender for Cloud is an asset-centric view that lists all monitored resources along with their current security configurations and health state. While inventory can filter resources by compliance findings, it does not aggregate or map the overall compliance status of the environment to a specific standard like SOC 2. Its purpose is resource discovery and management, not regulatory compliance reporting, so it does not meet the requirement.
- ✗
Secure Score
Why it's wrong here
The Secure Score in Defender for Cloud measures the overall security posture based on the implementation of security recommendations, producing a single numerical score. It reflects how well you have mitigated security risks through controls such as MFA or endpoint protection, but it is not mapped to regulatory standards like SOC 2. A high Secure Score does not imply compliance with any specific regulation, so it is an incorrect tool for SOC 2 reporting.
- ✗
Workbooks
Why it's wrong here
Workbooks in Defender for Cloud are customizable, interactive reporting canvases built on Azure Resource Graph and Log Analytics data. While you could manually construct a report to approximate compliance views, the Workbooks feature lacks the out-of-the-box control mapping, per-standard scoring, and automated status updates that the Regulatory compliance dashboard provides. The question asks for the feature that manages compliance, and the prebuilt dashboard is the simplest, most direct solution; creating a custom workbook is unnecessary and not the standard method.
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-500 question from scratch — 617 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.