Courseiva
← SC-200
Full test
hardMultiple ChoiceObjective-mapped

How to Add Regulatory Compliance Standards to Defender for Cloud Dashboard

A security administrator is configuring Microsoft Defender for Cloud's regulatory compliance dashboard for Azure resources. They need to track compliance against the SOC 2 standard using a built-in initiative. Which steps are required to add SOC 2 to the dashboard?

Quick Answer

The correct answer is to enable Defender for Cloud's enhanced security features, then assign the built-in SOC 2 policy initiative. This is required because the regulatory compliance dashboard is only accessible after you activate enhanced security features (formerly Azure Defender) on your subscription; without this step, the dashboard remains unavailable. Once enabled, you assign the built-in SOC 2 initiative, which automatically maps Azure Policy definitions to SOC 2 controls and populates the compliance status in the dashboard. On the SC-200 exam, this question tests your understanding that regulatory compliance is not a free feature—it depends on enhanced security being turned on first. A common trap is assuming you can assign any standard directly without enabling enhanced security, or confusing built-in initiatives with custom ones. Memory tip: think "Enhance first, assign second"—like turning on the power before plugging in the device.

⚠ Common exam trap

Many exam-takers assume the free tier of Defender for Cloud is sufficient for regulatory compliance tracking, but Microsoft specifically requires enhanced security features (paid tier) to enable the regulatory compliance dashboard and assign built-in initiatives like SOC 2.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Enable Defender for Cloud's enhanced security features, then assign the built-in SOC 2 policy initiative

Microsoft Defender for Cloud's regulatory compliance dashboard requires enhanced security features (formerly Azure Defender) to be enabled on the subscription. Once enabled, you can assign the built-in SOC 2 policy initiative, which automatically maps Azure Policy definitions to SOC 2 controls and displays compliance status in the dashboard. Without enhanced security features, the regulatory compliance dashboard is not available.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • ✗

    Enable Defender for Cloud on the subscription, then add the SOC 2 regulatory compliance initiative

    Why it's wrong here

    Enabling Defender for Cloud alone does not include SOC 2; the initiative must be assigned through the regulatory compliance blade, but the phrasing 'add' is vague and the step order should include enabling enhanced security.

  • ✓

    Enable Defender for Cloud's enhanced security features, then assign the built-in SOC 2 policy initiative

    Why this is correct

    Enhanced security features (Defender for Cloud plans) enable the full set of capabilities, and then the SOC 2 initiative can be assigned from the regulatory compliance dashboard.

  • ✗

    Create a custom policy initiative based on SOC 2 controls and assign it to the management group

    Why it's wrong here

    While a custom initiative could be created, a built-in SOC 2 initiative is available and is the recommended way to populate the dashboard.

  • ✗

    Configure Azure Policy manually with SOC 2 policies

    Why it's wrong here

    Manual Azure Policy configuration does not integrate with Defender for Cloud's regulatory compliance dashboard; the built-in initiative is the proper method.

About these practice questions

Courseiva writes every SC-200 question from scratch — 209 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Same concept, more angles

1 more way this is tested on SC-200

These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.

Variation 1. A security administrator is configuring Microsoft Defender for Cloud's regulatory compliance dashboard. The organization needs to be compliant with the NIST SP 800-53 standard. Which built-in initiative should the administrator assign to the subscription to populate the dashboard with NIST controls?

medium
  • A.Azure Security Benchmark
  • ✓ B.NIST SP 800-53 R5
  • C.CIS Microsoft Azure Foundations Benchmark
  • D.ISO 27001

Why B: The NIST SP 800-53 R5 built-in initiative is the correct choice because Microsoft Defender for Cloud includes a dedicated regulatory compliance policy initiative that maps directly to the NIST SP 800-53 standard's controls. Assigning this initiative to the subscription populates the regulatory compliance dashboard with the specific NIST controls and their compliance status, enabling the organization to track and report against that framework.

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.