mediumMultiple ChoiceObjective-mapped
SC-200 Practice Question: A security administrator wants to assess their…
A security administrator wants to assess their Azure environment against the Azure Security Benchmark and also include custom security controls defined by their organization. They need a single, reusable policy initiative that can be assigned across multiple subscriptions and management groups. What should the administrator create in Microsoft Defender for Cloud?
⚠ Common exam trap
A common mix-up: candidates confuse a single custom policy definition (Option C) with a policy initiative, not realizing that an initiative is the only way to group multiple controls into a single assignable package for compliance assessment.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A custom Azure Policy initiative
The administrator needs a single, reusable policy initiative that includes both Azure Security Benchmark controls and custom organizational controls. A custom Azure Policy initiative (also known as a policy set) allows combining multiple policy definitions, including built-in benchmark controls and custom definitions, into one assignable package across subscriptions and management groups. This is the correct approach because initiatives are designed for grouping related policies and can be assigned at scale in Microsoft Defender for Cloud.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A new regulatory compliance standard
Why it's wrong here
Defender for Cloud's regulatory compliance dashboard only supports built-in standards such as CIS MS, PCI DSS, and Azure Security Benchmark. The platform does not expose a 'custom standard' object; a custom requirement set must be modeled as a policy initiative and assigned, then the dashboard can display it via the custom initiative mapping. Therefore, selecting this option would not accomplish the assessment against the required controls.
- ✓
A custom Azure Policy initiative
Why this is correct
A custom Azure Policy initiative is the correct mechanism because an initiative bundles multiple policy definitions, including built-in Azure Security Benchmark definitions and your own custom definitions, into a single assignable unit. When assigned at the subscription or management group scope, it evaluates resources against both the benchmark's built-in controls and your additional custom rules. This satisfies the requirement to assess the environment against two combined sets of controls simultaneously.
- ✗
A custom Azure Policy definition
Why it's wrong here
A single custom Azure Policy definition is too granular; it only evaluates one specific condition, such as requiring a specific tag or enforcing a particular encryption setting. To assess against an entire security benchmark combined with custom controls, you would need dozens or hundreds of definitions grouped together. Since a standalone definition cannot represent the full benchmark scope, it is not the right solution here.
- ✗
A Secure Score recommendation override
Why it's wrong here
Secure Score recommendation overrides are designed to exempt or suppress individual recommendations—for example, to mark a recommendation as 'not applicable' for a particular resource or subscription. They do not introduce any new assessment logic or create additional controls; they only alter the scoring and status of existing recommendations. Thus, overrides cannot be used to assess the environment against a custom set of security requirements.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SC-200 question from scratch — 673 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.