SC-100 Practice Question: Design solutions that align with security best practices and priorities
Your organization plans to use Microsoft Defender for Cloud to secure Azure resources. The security team wants to continuously assess compliance against the CIS Azure Foundations Benchmark. What should you do?
⚠ Common exam trap
Watch out — candidates often think they need to create custom Azure Blueprints or manually assign Azure Policies for CIS compliance, overlooking that Defender for Cloud's regulatory compliance dashboard already includes a pre-configured, continuously updated CIS benchmark initiative that automates the entire assessment process.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable the CIS Azure Foundations Benchmark in Defender for Cloud regulatory compliance dashboard
Microsoft Defender for Cloud's regulatory compliance dashboard includes built-in support for the CIS Azure Foundations Benchmark. By enabling this standard in the dashboard, Defender for Cloud continuously assesses your Azure resources against all CIS controls, providing automated compliance scores and remediation recommendations without requiring custom definitions or manual policy assignments.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a custom Azure Blueprint for CIS
Why it's wrong here
Azure Blueprints orchestrate resource deployment by bundling policies, RBAC, and ARM templates, but they do not provide continuous compliance assessment or drift detection. A custom blueprint for CIS would only establish an initial configuration state, leaving ongoing monitoring and reporting to external tools. This fails to meet the requirement for an active compliance dashboard, so it is not the right approach.
- ✗
Deploy Azure Security Center (legacy)
Why it's wrong here
Azure Security Center is the legacy predecessor to Microsoft Defender for Cloud; its capabilities have been fully integrated into Defender for Cloud's plans, and the old portal experience is retired. Deploying it is not only unsupported but also redundant since your organization already plans to use Defender for Cloud. The legacy product lacked the modern regulatory compliance dashboard with automated CIS benchmark tracking, making it a obsolete choice.
- ✓
Enable the CIS Azure Foundations Benchmark in Defender for Cloud regulatory compliance dashboard
Why this is correct
Enabling the CIS Azure Foundations Benchmark in Defender for Cloud's regulatory compliance dashboard is the correct action because it automatically attaches a curated Azure Policy initiative containing the required policies and controls. The dashboard continuously assesses your Azure environment against CIS controls, provides a compliance score, and surfaces remediation recommendations. This directly supports the benchmark with minimal manual effort and ongoing visibility, fulfilling your organization's compliance monitoring requirement.
- ✗
Assign Azure Policy for all CIS controls manually
Why it's wrong here
Manually assigning Azure Policy definitions for every CIS control is error-prone, time-consuming, and requires you to map each control to the correct policy, handle versioning, and maintain custom initiatives. Defender for Cloud already provides built-in policy initiatives for CIS benchmarks, which are automatically applied when you enable the standard in the regulatory compliance dashboard. This manual approach duplicates existing functionality and introduces unnecessary risk of misconfiguration, so it is inefficient and impractical.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SC-100 question from scratch — 605 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-100 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-100 exam.