mediumMultiple ChoiceObjective-mapped
SC-200 Practice Question: A company uses Microsoft Defender for Cloud to…
A company uses Microsoft Defender for Cloud to manage security across multiple Azure subscriptions. They want to automatically remediate non-compliant resources when a policy violation is detected—for example, enabling encryption on a storage account that has it disabled. Which feature should they configure?
⚠ Common exam trap
A common mix-up: candidates confuse the Regulatory compliance dashboard (a monitoring tool) with an automated remediation feature, overlooking that Azure Policy's DeployIfNotExists effect is the actual mechanism for enforcing and fixing compliance violations.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Policy's DeployIfNotExists effect
Azure Policy's DeployIfNotExists effect is the correct feature because it automatically deploys a resource configuration (such as enabling encryption on a storage account) when a policy evaluation detects non-compliance. This effect runs during policy evaluation and remediation tasks, ensuring that the resource is brought into compliance without manual intervention. It is specifically designed for automated remediation of non-compliant resources in Azure, aligning with the requirement to fix violations like missing encryption.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Regulatory compliance dashboard
Why it's wrong here
The Regulatory Compliance dashboard in Microsoft Defender for Cloud provides a high-level view of your compliance posture against industry standards like CIS, NIST, and Azure Security Benchmark. However, it is purely a visibility and reporting tool—it can identify which resources are non-compliant and recommend remediation actions, but it cannot automatically deploy or change configuration on those resources. It lacks any enforcement or deployment capability, so it cannot automatically enable encryption on storage accounts.
- ✓
Azure Policy's DeployIfNotExists effect
Why this is correct
Azure Policy's DeployIfNotExists effect is a true remediation mechanism because it automatically deploys a requested configuration whenever a non-compliant resource is created or updated. When assigned, it evaluates resources against the policy definition and, if the specified condition is not met, it runs an ARM template or deployment to bring the resource into compliance. For example, if a policy requires storage encryption to be enabled, DeployIfNotExists can automatically enable it by deploying the encryption configuration, thus achieving continuous and automated remediation without human interaction.
- ✗
Adaptive network hardening
Why it's wrong here
Adaptive network hardening is a feature within Defender for Cloud that analyzes actual traffic patterns to and from virtual machines, and then recommends or automatically applies tighter network security group (NSG) rules to restrict access to only the least permissive set of thresholds that still allows legitimate traffic. Its scope is entirely limited to network-level controls like opening or closing ports and managing IP allowlists; it has no awareness of storage account settings or data-at-rest encryption. Consequently, it cannot remediate a missing encryption configuration on a storage account.
- ✗
Just-In-Time VM access
Why it's wrong here
Just-In-Time (JIT) VM access is a security control that reduces the attack surface of virtual machines by locking down inbound traffic and automatically opening ports only when an authorized user requests access for a specific time window. While useful for managing remote administration threats, it operates exclusively on VM network security group rules and does not interact with Azure storage or any data-at-rest configuration. Thus, it cannot enforce or remediate storage encryption settings, making it entirely irrelevant to the task of enabling encryption on storage accounts.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SC-200 question from scratch — 209 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.