SC-200 Practice Question: Continuously assess the compliance of their Azure…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Regulatory compliance dashboard

  Why this is correct

  The Regulatory compliance dashboard in Defender for Cloud is the dedicated feature that continuously assesses your Azure resources against built-in standards such as the CIS Microsoft Azure Foundations Benchmark and NIST SP 800-53. When you add a standard, Defender for Cloud assigns the corresponding Azure Policy initiative to your subscriptions, and the dashboard then shows the compliance state for each control, including the number of passed and failed resources. This dashboard is the correct choice because it explicitly links continuous policy evaluation to regulatory frameworks, allowing you to track and prove compliance over time.

• ✗

  Secure score

  Why it's wrong here

  Secure score is a percentile-based measure of how well you have implemented Microsoft's recommended security controls, aggregated across all resources in the environment. It is calculated from the remediation of Defender for Cloud recommendations, not from the specific control requirements of a compliance standard like CIS. Although a secure score of 100% may indicate a strong hardening posture, it does not demonstrate compliance with any particular regulatory framework, and you can have a high secure score while still failing specific CIS controls.

• ✗

  Azure Policy

  Why it's wrong here

  Azure Policy is the underlying rule-authoring and enforcement engine that applies initiatives to subscriptions, but by itself it does not present a consolidated compliance view against benchmark frameworks. Defender for Cloud does use Azure Policy to run the built-in CIS assignments, yet the service's Regulatory compliance dashboard is the actual interface that aggregates those continuous evaluations and shows which standards and controls are passing. Simply assigning a policy in Azure Policy does not give you the compliance dashboard experience; that is a Defender for Cloud feature.

• ✗

  Workload protections

  Why it's wrong here

  Workload protections in Defender for Cloud are focused on runtime threat detection and vulnerability management for compute, storage, and databases—not on evaluating resource configuration against regulatory frameworks. While those protections may generate alerting and recommendations, they do not provide a standards-based compliance scorecard that tracks controls like CIS MIS or NIST SP 800-53. Compliance assessment is about continuous configuration auditing and control mapping, which is fundamentally different from detecting an ongoing attack or suspicious activity.

Go deeper

Related to this question