SC-900 Practice Question: Describe the concepts of security, compliance, and identity

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Defender for Cloud’s regulatory compliance dashboard

  Why this is correct

  Microsoft Defender for Cloud's regulatory compliance dashboard is specifically designed to help organizations meet various industry and regulatory standards. It continuously assesses the compliance posture of resources against built-in and custom compliance standards, such as Azure Security Benchmark, PCI DSS, ISO 27001, and HIPAA. The dashboard provides a centralized view of compliance status, offering actionable recommendations and remediation steps to address non-compliant controls and improve overall adherence to regulatory requirements. This direct alignment with compliance frameworks makes it the ideal tool for assessing regulatory posture.

• ✗

  Microsoft Defender for Cloud Apps

  Why it's wrong here

  Microsoft Defender for Cloud Apps (MDCA) functions as a Cloud Access Security Broker (CASB), primarily focused on providing deep visibility, data travel control, and sophisticated threat protection across cloud applications. While it helps secure data and user activity within SaaS applications, its core purpose is not to directly assess an organization's adherence to specific regulatory compliance standards like PCI DSS or ISO 27001. Instead, it provides granular control and monitoring over cloud app usage, which can contribute to compliance but doesn't perform the assessment itself.

• ✗

  Microsoft Defender for Identity

  Why it's wrong here

  Microsoft Defender for Identity (MDI) is a cloud-based security solution that leverages on-premises Active Directory signals to identify, detect, and investigate advanced threats, compromised identities, and malicious insider actions. Its primary role is to protect hybrid identity environments by monitoring user behavior and detecting anomalies indicative of attacks like pass-the-hash or Golden Ticket. While crucial for identity security, MDI does not offer capabilities for assessing an organization's overall regulatory compliance posture against standards like HIPAA or GDPR.

• ✗

  Defender for Cloud’s Secure Score

  Why it's wrong here

  Microsoft Defender for Cloud's Secure Score is a dynamic measurement of an organization's security posture, providing a numerical representation of how well security controls are implemented. It aggregates security recommendations into a single score, helping prioritize actions to improve overall security. While a high Secure Score indicates strong security practices, it does not directly map to specific regulatory compliance standards or provide a dashboard for tracking adherence to frameworks like ISO 27001 or PCI DSS. Its focus is on general security hardening, not formal compliance assessment.

Go deeper

Related to this question