easyMultiple ChoiceObjective-mapped
Assign Azure Security Benchmark Initiative to Management Group
A security engineer needs to ensure that all Azure subscriptions under a management group are continuously assessed against the Azure Security Benchmark. They want to see the aggregated compliance score at the management group level. What should the engineer do in Microsoft Defender for Cloud?
Quick Answer
The answer is to assign the Azure Security Benchmark initiative to the management group. This is correct because the Azure Security Benchmark initiative, when assigned at the management group scope, propagates its policy definitions and continuous assessment down to all child subscriptions, enabling Defender for Cloud to aggregate compliance data from every subscription into a single, unified compliance score visible in the Regulatory Compliance dashboard. On the SC-200 exam, this scenario tests your understanding of policy inheritance and scope-based compliance aggregation, often appearing as a distractor where candidates mistakenly assign the initiative to individual subscriptions or enable a single Defender plan instead. A common trap is thinking you need to configure each subscription separately, but the management group assignment handles the entire hierarchy at once. Memory tip: think of the management group as the root of a tree—water the root, and every branch gets assessed.
⚠ Common exam trap
Watch out — candidates often think they need to enable the Regulatory Compliance dashboard (Option C) or configure Secure Score policies (Option D) to see aggregated scores, but the critical step is assigning the initiative at the correct scope—the management group—to enable both continuous assessment and aggregation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Assign the Azure Security Benchmark initiative to the management group.
Assigning the Azure Security Benchmark initiative to the management group ensures that all subscriptions under that management group are continuously assessed against the benchmark. The aggregated compliance score is then visible at the management group level in the Regulatory Compliance dashboard, providing a single view of compliance across the entire hierarchy.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Assign the Azure Security Benchmark initiative to each subscription individually and use the secure score dashboard.
Why it's wrong here
Assigning individually does not aggregate scores at management group level, and secure score is not the same as regulatory compliance.
- ✓
Assign the Azure Security Benchmark initiative to the management group.
Why this is correct
When assigned to a management group, the initiative applies to all subscriptions under it, and the Regulatory Compliance dashboard shows aggregated compliance.
- ✗
Enable the Regulatory Compliance dashboard and select the Azure Security Benchmark from the built-in standards list.
Why it's wrong here
The dashboard only displays results from initiatives that have been assigned; it does not assign them.
- ✗
Configure Secure Score policies at the management group and enable Azure Security Benchmark.
Why it's wrong here
Secure Score does not use regulatory compliance standards in this manner.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SC-200 question from scratch — 209 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SC-200
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A global organization has Azure subscriptions organized under a single management group. The security team wants to ensure that the Azure Security Benchmark initiative is assigned once to cover all current and future subscriptions within that management group, without needing to assign it individually. They also want to see compliance results aggregated at the management group level. In Microsoft Defender for Cloud, what is the correct approach to achieve this?
hard- ✓ A.Assign the Azure Security Benchmark initiative directly to the management group via Azure Policy, and use the Defender for Cloud's Regulatory Compliance dashboard.
- B.Enable Defender for Cloud's enhanced security features on each subscription, and the benchmark will be automatically applied.
- C.Create a custom assessment in Defender for Cloud that queries the management group scope.
- D.Assign the initiative to the root management group using Azure Policy, then configure Defender for Cloud to ignore individual subscription assignments.
Why A: Assigning the Azure Security Benchmark initiative directly to the management group via Azure Policy ensures that the policy initiative is inherited by all current and future subscriptions under that management group. Defender for Cloud's Regulatory Compliance dashboard then aggregates compliance results at the management group level, providing a single view of compliance across the entire hierarchy without requiring individual assignments.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.