AZ-900 Describe Azure management and governance Practice Question
An organization wants to review the compliance status of all resources across multiple subscriptions against a set of regulatory standards. Which Azure tool provides this consolidated view?
⚠ Common exam trap
A common mix-up: candidates confuse Azure Policy's ability to enforce compliance rules with Defender for Cloud's consolidated compliance dashboard, but Azure Policy alone does not aggregate compliance status across multiple subscriptions against regulatory standards—Defender for Cloud provides that unified view.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Defender for Cloud
Microsoft Defender for Cloud (formerly Azure Security Center) provides a unified view of compliance posture across all Azure subscriptions by continuously assessing resources against built-in regulatory standards (e.g., SOC 2, ISO 27001, PCI DSS) and custom policies. It aggregates compliance scores, recommendations, and security findings into a single dashboard, enabling centralized compliance management.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure Monitor
Why it's wrong here
Azure Monitor is a telemetry service that collects metrics, logs, and activity data from Azure resources to track performance, availability, and operational health. It offers alerting and visualization but does not assess resources against regulatory standards like ISO or SOC 2. While it can surface activity logs relevant to auditing, it lacks the built-in compliance evaluation and multi-standard dashboard needed for regulatory compliance reports.
- ✗
Azure Advisor
Why it's wrong here
Azure Advisor is a personalized recommendation engine that analyzes resource configurations and usage to suggest best practices in cost, security, reliability, performance, and operational excellence. It does not track or enforce mandated regulatory frameworks, and its security recommendations are generic rather than compliance-driven. Regulatory compliance status is fundamentally different from advisory guidance because it requires attestation against specific standards, which Advisor does not provide.
- ✓
Microsoft Defender for Cloud
Why this is correct
Microsoft Defender for Cloud includes a dedicated regulatory compliance dashboard that aggregates security findings and policy evaluations across all subscriptions against a wide range of built-in standards, such as CIS, NIST, Azure Security Benchmark, and ISO 27001. This dashboard gives a unified percentage-based posture, provides per-standard drill-downs, and supports adding custom initiatives to align with specific regulatory requirements. It is the correct Azure service for viewing consolidated multi-standard regulatory compliance at scale.
- ✗
Azure Policy
Why it's wrong here
Azure Policy is the underlying service that creates, assigns, and manages rules to enforce or audit resource behavior, and it can produce policy-level compliance results. However, the question specifically asks for a consolidated multi-standard regulatory view, which requires more than raw policy evaluation; it needs a curated dashboard that aggregates results across multiple compliance frameworks. Microsoft Defender for Cloud builds on Azure Policy to offer that preconfigured regulatory compliance dashboard, while Azure Policy itself remains a granular control engine.
Go deeper
Related to this question
Learn chapter
Azure Cost Management and Billing
Key term
Dashboard
A dashboard is a visual display of key metrics and data points that helps IT professionals monitor, analyze, and manage systems or processes in real time.
Key term
Microsoft Defender for Cloud
Microsoft Defender for Cloud is a cloud-native application protection platform that provides unified security management and advanced threat protection across multicloud and hybrid environments.
About these practice questions
One of 981 original AZ-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.