SC-100 Practice Question: Design security operations, identity, and compliance capabilities

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Configure AWS Config and GCP Security Command Center to export findings to Microsoft Sentinel

  Why it's wrong here

  Exporting AWS Config and GCP Security Command Center data to Microsoft Sentinel centralizes alerts and logs in a SIEM, enabling cross-cloud detection and investigation, but it does not enforce a security baseline. Sentinel is reactive—it analyzes ingested signals; it cannot automatically deploy configuration policies or remediate noncompliant resources. A single baseline requires continuous compliance assessment and governance, which Azure Policy in Defender for Cloud provides, not log ingestion.

• ✓

  Connect AWS and GCP accounts to Defender for Cloud and use Azure Policy to enforce the Microsoft Cloud Security Benchmark

  Why this is correct

  Connecting AWS and GCP accounts to Defender for Cloud surfaces those resources in Azure Resource Graph, where Azure Policy can apply the Microsoft Cloud Security Benchmark (MCSB), a unified initiative built on CIS/NIST plus Microsoft controls. This gives continuous compliance assessment and enforcement, like DeployIfNotExists remediation, across all clouds. As a result, every subscription or cloud account is measured against the same baseline, regardless of native cloud tooling—this is the only option that both centralizes and enforces a single baseline.

• ✗

  Use regulatory compliance standards for each cloud separately

  Why it's wrong here

  Using each cloud's own regulatory compliance standards—like Center for Internet Security benchmarks for AWS, GCP, and Azure—fragments the baseline because those standards differ in control mappings, versioning, and scope. Regulatory compliance is a framework mapping, not a customizable security policy that can be enforced across clouds; it only reports adherence. Without a common control framework like the Microsoft Cloud Security Benchmark, you cannot enforce a single, consistent security baseline across all environments.

• ✗

  Enable the Cloud Security Posture Management (CSPM) plan and configure AWS and GCP connectors

  Why it's wrong here

  Enabling the CSPM plan and configuring AWS/GCP connectors provides asset visibility and security recommendations from Defender for Cloud, which is a necessary precursor for multi-cloud governance. However, by default CSPM assesses each cloud against its own native recommendations—AWS Security Hub controls and GCP security analytics—rather than a single policy set. To enforce a unified baseline, you must attach Azure Policy initiatives like MCSB to the connectors; otherwise, you have posture data but not standardized enforcement.

Go deeper

Related to this question