AZ-500 Manage identity and access Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Security Policy

  Why it's wrong here

  Security Policy is the configuration surface where you define which regulatory standards and custom initiatives are assigned to a scope, such as the Microsoft Cloud Security Benchmark (MCSB). It establishes the compliance baseline and maps recommendations to controls, but it does not produce a real-time compliance score or a visual breakdown of passing versus failing controls. Compliance data is only observable after you provision standards to a scope, and then you must separately navigate to the Regulatory Compliance dashboard to view the assessment results. In short, Security Policy is the control plane for compliance measurement, not the reporting tool.

• ✓

  Regulatory Compliance dashboard

  Why this is correct

  The Regulatory Compliance dashboard is the dedicated reporting interface within Microsoft Defender for Cloud that continuously aggregates assessment results for assigned standards like MCSB. It provides a compliance score per standard, a per-control breakdown of pass and fail status, and drill-down details for each recommendation that impacts a control. This dashboard directly answers the requirement to assess compliance against a chosen regulatory framework by showing exactly which controls are not met and why. It is the correct tool because it maps Azure Security benchmark recommendations to regulatory compliance controls and offers a visual, actionable score.

• ✗

  Secure Score

  Why it's wrong here

  Secure Score is a metric that reflects your overall security posture by summing the potential improvement points from all security recommendations, regardless of any regulatory standard. It measures how well you are following Azure's best-practice baseline (which is aligned with MCSB), but it does not show you a compliance score for a specific regulation or display controls broken out by standard. For example, Secure Score will not tell you which specific MCSB controls you failed or how your compliance posture differs across standards you have assigned. Thus, while Secure Score is useful for prioritizing hardening actions, it is not a compliance assessment tool.

• ✗

  Workload Protections

  Why it's wrong here

  Workload Protections is a feature set in Defender for Cloud that enables paid detection capabilities, such as Microsoft Defender for servers, databases, and containers, to provide threat detection, vulnerability management, and security alerts. It is designed to secure your workloads in real time and investigate attacks, not to generate compliance reports or track adherence to regulatory standards. While some vulnerability findings from Workload Protections may feed into recommendations that affect compliance, the service itself does not display a regulatory compliance status or a control-by-control assessment. Therefore, choosing Workload Protections would fail to meet the requirement for continuously assessing compliance with MCSB.

Go deeper

Related to this question