Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel →mediumMultiple SelectObjective-mapped
What Are the Features of Microsoft Defender for Cloud's CSPM?
Which THREE of the following are features of Microsoft Defender for Cloud's Cloud Security Posture Management (CSPM)?
Quick Answer
The answer is regulatory compliance assessments, along with Secure Score and security recommendations, as the three features of Microsoft Defender for Cloud's Cloud Security Posture Management (CSPM). These three work together to continuously evaluate your Azure environment against industry standards and best practices: Secure Score quantifies your overall security hygiene, regulatory compliance assessments map your resources against frameworks like CIS or NIST, and security recommendations provide actionable steps to improve that posture. On the AZ-500 exam, this question tests your ability to distinguish CSPM’s preventive, configuration-focused features from Defender for Cloud’s workload protection capabilities, which include threat detection and vulnerability scanning—common traps where candidates mistakenly include those as CSPM features. Remember that CSPM is about “posture” and “compliance,” not active threat hunting; a simple memory tip is to think of the three C’s: Compliance, Configuration, and Control (Secure Score).
⚠ Common exam trap
Watch out — candidates often confuse CSPM's configuration-based recommendations and Secure Score with the threat detection and vulnerability scanning features that belong to separate Defender for Cloud workload protection plans, leading them to select options A or D as CSPM features.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Security recommendations for resources
CSPM in Microsoft Defender for Cloud continuously assesses Azure resources against built-in security policies and industry best practices, generating actionable security recommendations to harden the environment. These recommendations are derived from the Azure Security Benchmark and are displayed in the Recommendations blade, directly influencing the Secure Score.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Vulnerability scanning of containers
Why it's wrong here
Vulnerability scanning is a workload protection feature.
- ✓
Security recommendations for resources
Why this is correct
CSPM generates recommendations to improve security.
- ✓
Secure Score
Why this is correct
Secure Score measures security posture.
- ✗
Threat detection for VMs
Why it's wrong here
Threat detection is part of workload protection, not CSPM.
- ✓
Regulatory compliance assessments
Why this is correct
CSPM includes compliance assessments against standards.
Go deeper
Related to this question
About these practice questions
This AZ-500 question is part of Courseiva's 194-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on AZ-500
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which THREE of the following are capabilities of Microsoft Defender for Cloud's Cloud Security Posture Management (CSPM) plan? (Select three.)
hard- ✓ A.Continuous assessment of security configurations.
- ✓ B.Secure score tracking and improvement.
- C.Just-in-time (JIT) VM access.
- ✓ D.Security recommendations based on the Microsoft Cloud Security Benchmark.
- E.File Integrity Monitoring (FIM).
Why A: Microsoft Defender for Cloud's CSPM plan continuously assesses your Azure resources against security best practices, identifying misconfigurations and drift in real-time. This continuous assessment is a core capability of CSPM, enabling proactive security posture management.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.