mediumMultiple SelectObjective-mapped
Three Actions to Effectively Manage Azure Security Benchmark Recommendations
A company uses Microsoft Defender for Cloud to assess compliance with Azure Security Benchmark (ASB). The security team wants to ensure that all recommendations are being followed. Which three actions should the team take to manage and remediate recommendations effectively?
Quick Answer
The answer is to enable automatic provisioning of the Log Analytics agent for all supported VMs. This action is correct because it ensures continuous collection of security configuration data from Azure VMs, which Microsoft Defender for Cloud then evaluates against Azure Security Benchmark (ASB) controls, allowing the security team to manage and remediate Azure Security Benchmark recommendations through a centralized, queryable data stream. On the Microsoft Cybersecurity Architect exam, this concept tests your understanding of how to operationalize compliance monitoring at scale, often appearing as a distractor where candidates mistakenly focus on manual remediation or single-policy fixes rather than automated data collection. A common trap is confusing automatic provisioning with manual agent installation; remember that “auto-provisioning” is the key to continuous compliance visibility. Memory tip: think “Auto-Provision = Auto-Compliance” to link the agent deployment directly to effective recommendation management.
⚠ Common exam trap
Candidates often think manual monthly remediation (Option B) is sufficient for compliance, but the SC-100 exam emphasizes continuous, automated monitoring and remediation as a core principle of a secure operations strategy.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable continuous export of compliance data to Log Analytics or Event Hubs.
Enabling continuous export of compliance data to Log Analytics or Event Hubs allows the security team to centralize, query, and monitor compliance data over time. This is essential for tracking the status of all Azure Security Benchmark recommendations, creating custom alerts, and integrating with SIEM or automation workflows. Option C is correct because creating exemption rules for resources that are compliant by other means (e.g., via a third-party tool or compensating controls) prevents false positives and reduces alert fatigue while maintaining accurate compliance posture. Option D is correct because enabling automatic provisioning of the Log Analytics agent ensures that all supported VMs are monitored and can report their compliance status, which is a foundational requirement for many ASB recommendations. Options B and E are incorrect: manual monthly remediation is not scalable or continuous, and disabling recommendations should be done via exemptions rather than outright disabling to maintain auditability.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enable continuous export of compliance data to Log Analytics or Event Hubs.
Why this is correct
Continuous export allows for long-term retention and analysis of compliance data.
- ✗
Manually remediate all high-severity recommendations each month.
Why it's wrong here
Manual remediation is not efficient; automatic remediation should be used where possible.
- ✓
Create exemption rules for resources that are compliant by other means.
Why this is correct
Exemptions help avoid false positives for resources that meet the intent of the recommendation.
- ✓
Enable automatic provisioning of the Log Analytics agent for all supported VMs.
Why this is correct
This ensures that the necessary data is collected for ASB recommendations.
- ✗
Disable recommendations that are not applicable to the environment.
Why it's wrong here
Disabling recommendations is not recommended; use exemptions instead.
Go deeper
Related to this question
About these practice questions
This SC-100 question is part of Courseiva's 208-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SC-100
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company uses Microsoft Defender for Cloud to assess the security posture of their Azure subscriptions. They want to ensure that critical recommendations are automatically remediated. They create a workflow automation that triggers a Logic App for specific recommendations. However, the Logic App fails to run. What is the most likely cause?
medium- ✓ A.The managed identity of the Logic App lacks permissions on the target resources.
- B.The subscription is not onboarded to Defender for Cloud.
- C.Defender for Cloud is disabled for the resource group.
- D.The recommendation is disabled in the security policy.
Why A: The most likely cause is that the Logic App's managed identity lacks the necessary permissions on the target Azure resources. Workflow automations in Defender for Cloud use a Logic App that executes remediation actions; if the Logic App's identity (either system-assigned or user-assigned) does not have the required RBAC role (e.g., Contributor or a custom role with specific actions) on the resource scope, the remediation run will fail with an authorization error. This is a common misconfiguration because the automation trigger itself succeeds, but the downstream action fails due to insufficient permissions.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-100 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-100 exam.