easyMultiple Choice
SC-200 Practice Question: A security administrator needs to view a list of…
A security administrator needs to view a list of all virtual machines that have a missing critical security update. Which Microsoft Defender for Cloud dashboard should they use?
⚠ Common exam trap
Test-takers frequently confuse the Inventory dashboard (which lists all resources) with the Recommendations dashboard (which provides actionable security findings), leading them to select Inventory instead of the correct Recommendations option.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Recommendations
The Recommendations dashboard in Microsoft Defender for Cloud provides a prioritized list of security recommendations, including missing critical security updates for virtual machines. This dashboard aggregates findings from vulnerability assessments and update management, allowing administrators to identify and remediate specific missing patches across their VM fleet.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Secure Score
Why it's wrong here
The Secure Score in Defender for Cloud is a percentage-based metric that measures your overall security posture by summing points earned from implemented recommendations. It does not display a list of VMs or their update status; rather, it shows the score contribution of the 'System updates' control and how many points are lost due to non-compliant resources. To see the actual VMs, you must drill down from the control to the underlying recommendation, making Secure Score a summary, not a resource list.
- ✗
Regulatory Compliance
Why it's wrong here
The Regulatory Compliance dashboard maps your Azure environment to compliance standards such as CIS, NIST SP 800-53, and Azure Security Benchmark, organizing assessments under standard-specific controls. Although a control like 'Vulnerability Management' may reference missing updates, the dashboard only indicates whether the control is passed or failed at a policy level, without enumerating the individual VMs that lack critical patches. It focuses on standards alignment, not on providing a resource-centric list of deficient machines, so you must navigate to the corresponding recommendation for resource-level details.
- ✗
Inventory
Why it's wrong here
The Inventory page in Defender for Cloud presents a filterable table of all discovered resources, including virtual machines, with columns for resource name, subscription, resource group, and type. It is a static view of your asset inventory and does not perform any security assessment or patch-state validation, so a VM missing critical updates appears identical to a fully patched VM. You cannot derive missing-update status from Inventory alone; that information lives in the recommendation assessments under the Recommendations blade.
- ✓
Recommendations
Why this is correct
In Microsoft Defender for Cloud, the Recommendations blade aggregates all security assessments, including the built-in recommendation 'System updates should be installed on your machines' (assessment key 4ab39e73-6c9d-4c5e-a9e7-5f2f2b3b3b3b). This assessment evaluates each virtual machine for missing critical or security updates and lists the affected resources with their patch status directly in the recommendation's 'Affected resources' tab. Therefore, this is the correct place to view all VMs missing critical updates.
Go deeper
Related to this question
About these practice questions
One of 1,303 original SC-200 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.