SC-100 Practice Question: Design solutions that align with security best practices and priorities

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Use the Azure Security Benchmark initiative

  Why it's wrong here

  The Azure Security Benchmark initiative is a comprehensive set of security recommendations based on industry-accepted best practices, but it serves as a general security baseline rather than a business-impact-driven prioritization mechanism. While it helps you harden your environment across multiple domains, it does not incorporate organizational context such as asset criticality, data classification, or specific regulatory obligations that directly reflect business priorities. Consequently, following the benchmark alone will not tell you which findings to remediate first when business impact is the deciding factor.

• ✓

  Enable the Regulatory Compliance dashboard

  Why this is correct

  The Regulatory Compliance dashboard in Microsoft Defender for Cloud maps security findings to specific regulatory standards (e.g., CIS, NIST SP 800-53, PCI DSS, ISO 27001) and tracks compliance status for each control. This directly ties security gaps to business and legal obligations, enabling you to prioritize remediation efforts based on which non-compliant controls carry the highest regulatory and business impact. By focusing on the standards that matter to your organization, you can align operational security work with audit deadlines, contractual obligations, and risk tolerance, making it the correct method for business-impact-centric prioritization.

• ✗

  Set up workflow automation for high-severity findings

  Why it's wrong here

  Workflow automation for high-severity findings (e.g., using Azure Logic Apps or Microsoft Sentinel playbooks) is designed to trigger automated responses like opening incidents, sending emails, or creating tickets when a high-severity alert fires. However, severity in Defender for Cloud is determined by the potential security impact of the finding, not by the business criticality of the affected resource or its relevance to compliance mandates. Therefore, while automation improves response efficiency, it does not prioritize which findings matter most to your organization; it only reacts to a predefined, generic severity level without considering business context.

• ✗

  Configure the Secure Score dashboard

  Why it's wrong here

  The Secure Score dashboard aggregates all security recommendations into a single posture score, giving you a high-level view of your overall security hygiene. However, it treats each recommendation equally for scoring purposes, so it does not weigh findings by business impact, asset sensitivity, or regulatory requirements. A low-severity finding on a non-critical resource can contribute as much score improvement as a high-impact finding on a crown-jewel asset, misleading prioritization. Thus, Secure Score is useful for tracking general security health but is not designed to guide business-driven remediation order.

Go deeper

Related to this question