AZ-900 Describe Azure management and governance Practice Question
Which Azure service provides compliance documentation, audit reports, and regulatory certifications to help organizations meet their own compliance obligations?
⚠ Common exam trap
Many candidates confuse Azure Policy's compliance dashboard (which shows policy compliance of their own resources) with the Service Trust Portal (which provides Microsoft's third-party audit reports and certifications), leading them to select Azure Policy instead of the correct service.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Service Trust Portal
The Microsoft Service Trust Portal (STP) is the dedicated Azure service that provides access to compliance documentation, audit reports, and regulatory certifications. It aggregates detailed information about Microsoft's security and compliance practices, including ISO 27001, SOC 2, and FedRAMP reports, enabling organizations to verify Azure's adherence to standards and fulfill their own compliance obligations.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure Policy compliance dashboard
Why it's wrong here
Azure Policy compliance dashboard shows whether your deployed Azure resources meet the policies you define, such as allowed locations or required tags. It is a governance tool for your own environment, not a source of Microsoft's third-party audit reports or certifications. The Service Trust Portal is the authoritative repository for Microsoft's compliance documentation, so this option cannot be correct.
- ✓
Microsoft Service Trust Portal
Why this is correct
Microsoft Service Trust Portal is the official site where Microsoft publishes its compliance documentation, including audit reports, certifications, and data protection resources for Azure and other cloud services. It allows customers to review independent assessments such as SOC reports, ISO certificates, and FedRAMP system security plans. This is exactly what a customer needs to meet their own compliance obligations while using Microsoft's cloud, making it the correct answer.
- ✗
Microsoft Defender for Cloud
Why it's wrong here
Microsoft Defender for Cloud delivers security posture management, workload protection, and regulatory compliance assessments (CIS, PCI DSS, etc.) for your own subscriptions. It surfaces gaps in your resource configurations and applies built-in or custom initiatives, but it does not host Microsoft's own audit evidence like SOC 2 or ISO 27001 reports. Therefore it is a security monitoring service, not the compliance document portal the question asks for.
- ✗
Azure Security Center
Why it's wrong here
Azure Security Center (now largely incorporated into Microsoft Defender for Cloud) focuses on security alerts, vulnerability scanning, and hardening recommendations for your own resources. It does not provide Microsoft's compliance evidence or audited certifications; rather, it helps you assess the security posture of your own workloads. Since the Service Trust Portal is the designated source for Microsoft's compliance material, this option is incorrect.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 981 original AZ-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.