Design solutions that align with security best practices and priorities →easyMultiple ChoiceObjective-mapped
SC-100 Practice Question: Design solutions that align with security best practices and priorities
Your organization wants to implement a security baseline for Azure resources using built-in policies. Which Azure service should you use to assign policies that enforce compliance with security best practices?
⚠ Common exam trap
Many candidates confuse Azure Policy with Microsoft Defender for Cloud, thinking Defender for Cloud is the tool for enforcing security baselines, but Defender for Cloud only recommends policies and monitors compliance, while Azure Policy is the actual service that enforces them.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Policy
Azure Policy is the correct service because it allows you to create, assign, and manage policies that enforce specific rules and effects on your Azure resources. These policies can be used to implement a security baseline by ensuring resources comply with built-in security best practices, such as requiring encryption or restricting resource types. Azure Policy evaluates resources against assigned policies and can automatically remediate non-compliant resources.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure Blueprints
Why it's wrong here
Azure Blueprints was an orchestration service designed to package together reusable Azure resources, policies, and role assignments into a deployable environment, but it has been deprecated in favor of Azure Policy and ARM templates. While it could embed policies, its primary focus was environment composition, not continuous security baseline enforcement. For consistency with current best practices, use Azure Policy to enforce compliance rules across both existing and newly created resources, as Blueprints no longer receives updates or support.
- ✗
Microsoft Defender for Cloud
Why it's wrong here
Microsoft Defender for Cloud offers cloud security posture management (CSPM) and workload protection, generating security recommendations and compliance scores based on regulatory standards. However, it is a visibility and assessment tool, not an enforcement engine; it does not assign policies that deny or remediate non-compliant configuration changes. Its recommendations can be exported to Azure Policy for action, but the actual policy enforcement resides in Azure Policy, not Defender for Cloud.
- ✓
Azure Policy
Why this is correct
Azure Policy is the correct service for implementing a security baseline because it creates, assigns, and manages rules that audit, deny, or remediate resource properties. It includes built-in policy definitions for the Azure Security Benchmark and other regulatory standards, enabling consistent enforcement across all resources. Policies can be applied to resource groups, subscriptions, and management groups, ensuring that new and existing resources continuously meet security requirements like encryption, network restrictions, and version compliance.
- ✗
Azure Role-Based Access Control (RBAC)
Why it's wrong here
Azure Role-Based Access Control (RBAC) governs authorization by controlling who can perform specific operations on Azure resources through role assignments to users, groups, or service principals. It does not evaluate or enforce resource configuration settings such as firewall rules, TLS versions, or diagnostic logging, which are typical security baseline requirements. RBAC is essential for limiting administrative access, but it is orthogonal to policy-based compliance enforcement; assigning roles cannot guarantee that resources are configured according to security standards.
Go deeper
Related to this question
About these practice questions
One of 208 original SC-100 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-100 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-100 exam.