SC-200 A company uses Microsoft Defender for Cloud Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Regulatory compliance dashboard

  Why this is correct

  The Regulatory compliance dashboard in Microsoft Defender for Cloud is the dedicated feature that assesses resources against built-in regulatory initiatives such as CIS, Azure Security Benchmark, and other standards. It provides a continuous compliance score with per-control status, showing which resources pass or fail each benchmark requirement. Because you can add or remove standards and see detailed remediation steps, this dashboard is the direct answer for monitoring compliance against CIS benchmarks.

• ✗

  Secure Score

  Why it's wrong here

  Secure Score is a quantitative measure of your organization's overall security posture based on the percentage of completed security recommendations within Defender for Cloud. It aggregates control health across categories like identity, networking, and data, but it does not map those recommendations to specific regulatory standards such as CIS. Thus, while Secure Score helps prioritize security improvements, it does not provide a compliance assessment against a named benchmark and is not the correct feature for this need.

• ✗

  Azure Policy

  Why it's wrong here

  Azure Policy is the underlying governance engine that enforces and evaluates resource configurations using policy definitions and initiatives. Defender for Cloud uses Azure Policy to run the assessments that feed both Secure Score and the Regulatory compliance dashboard, but Azure Policy itself does not expose a user-facing compliance view for standards like CIS. The Regulatory compliance dashboard is the feature that consumes those Azure Policy evaluations and presents them in a standard-specific compliance matrix, so Azure Policy alone does not satisfy the requirement.

• ✗

  Just-In-Time VM access

  Why it's wrong here

  Just-In-Time (JIT) VM access is a security control in Defender for Cloud that limits network exposure by locking down inbound ports and granting time-bound access when needed. It is designed to reduce the attack surface for brute-force attacks and is not a compliance assessment mechanism. JIT VM access does not evaluate resources against CIS benchmark controls or any regulatory framework, so it is completely unrelated to the need to assess compliance with a specific standard.

Go deeper

Related to this question