AZ-900 Describe Azure management and governance Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Azure Security Center Secure Score

  Why it's wrong here

  Secure Score in Microsoft Defender for Cloud is a numeric summary (0–100%) of your overall security posture, calculated from the percentage of security recommendations you have completed. It aggregates many security controls and gives a single hygiene score, but it does not group results by regulatory standards or indicate whether you meet PCI DSS, ISO 27001, or NIST requirements. Because it measures general security hardening rather than specific regulatory controls, Secure Score is not a substitute for the Regulatory Compliance dashboard.

• ✓

  Microsoft Defender for Cloud Regulatory Compliance

  Why this is correct

  Microsoft Defender for Cloud's Regulatory Compliance dashboard (also available in Azure Security Center) provides exactly the needed pass/fail monitoring against specific regulatory standards, including ISO 27001, PCI DSS 3.2.1, NIST SP 800-53, SOC 2, and Azure CIS 1.1.0/1.3.0. It continuously evaluates connected Azure and hybrid resources, maps assessment results to each standard's control requirements, and shows which controls are passing or failing. You can select the standards you need, view per-control results, track history, and export evidence, making it the superior tool for regulatory compliance in Azure.

• ✗

  Azure Policy compliance view

  Why it's wrong here

  Azure Policy compliance view evaluates Azure resources against your own custom or built-in policy definitions—such as requiring specific tags, restricting resource locations, or enforcing encryption—to report whether resources are compliant with those governance rules. Unlike regulatory compliance, it does not automatically score resources against external standards like ISO 27001 or PCI DSS; it only tracks adherence to policies you have assigned in your environment. Therefore, while Azure Policy can help implement controls, its compliance view is not a prebuilt regulatory framework assessment.

• ✗

  Azure Advisor security recommendations

  Why it's wrong here

  Azure Advisor's security recommendations offer prioritized, best-practice suggestions based on Azure's security guidelines, such as enabling just-in-time VM access, updating OS versions, or enabling network security groups. These recommendations are derived from Azure Security Center's security assessments but are not framed against a specific regulatory standard; they do not show pass/fail status for individual clauses of ISO 27001 or PCI DSS. Advisor focuses on remediating general security weaknesses rather than certifying compliance with external regulations.

Go deeper

Related to this question