SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
A company uses Microsoft Defender for Cloud to secure their Azure environment. The security team needs to check whether their resources comply with the CIS (Center for Internet Security) benchmark. How can they view their compliance status against CIS in Defender for Cloud?
⚠ Common exam trap
Watch out — candidates often confuse secure score recommendations with regulatory compliance assessments, assuming that secure score covers all compliance standards, when in fact secure score is a separate metric based on security controls, not specific regulatory frameworks like CIS.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use the Regulatory Compliance dashboard and add the CIS standard as a compliance initiative
The Regulatory Compliance dashboard in Microsoft Defender for Cloud allows you to add built-in compliance standards like CIS as an initiative. Once added, the dashboard continuously assesses your Azure resources against the CIS benchmark controls and displays pass/fail status. This is the correct method because Defender for Cloud integrates with Azure Policy to evaluate compliance against regulatory standards.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use the secure score recommendations and look for CIS-related controls
Why it's wrong here
The secure score in Microsoft Defender for Cloud provides a prioritized list of security recommendations to improve your overall security posture. While some of these recommendations might align with general security best practices found in CIS benchmarks, the secure score does not offer a direct, comprehensive mapping or reporting mechanism against the specific controls of a regulatory standard like CIS. It is an operational metric focused on security improvement, not a dedicated compliance reporting tool.
- ✓
Use the Regulatory Compliance dashboard and add the CIS standard as a compliance initiative
Why this is correct
The Regulatory Compliance dashboard in Microsoft Defender for Cloud is specifically designed to assess and report on your organization's adherence to various industry standards and regulatory benchmarks. By adding the CIS standard as a compliance initiative, Defender for Cloud automatically maps relevant security recommendations and assessments to the specific controls within that standard, providing a consolidated view of your compliance posture. This direct integration enables comprehensive tracking and reporting against the chosen benchmark.
- ✗
Use Azure Policy initiative assignments directly from the Policy service
Why it's wrong here
While CIS benchmarks are implemented as Azure Policy initiatives, the user can view compliance in Defender for Cloud's Regulatory Compliance dashboard. The Policy service shows compliance per initiative, but the question asks specifically about Defender for Cloud.
- ✗
Use the vulnerability assessment solution for machines to check CIS settings
Why it's wrong here
Vulnerability assessment solutions, such as those integrated with Defender for Cloud (e.g., Qualys or Microsoft Defender for Endpoint's TVM), primarily identify software weaknesses, missing patches, and common misconfigurations on virtual machines and servers. While some identified misconfigurations might overlap with specific CIS controls, these tools do not offer a holistic, control-by-control assessment or reporting framework for the entire CIS benchmark across an organization's cloud environment. Their scope is limited to machine-level security hygiene, not broad regulatory compliance.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Compliance
Compliance is the process of ensuring that an organization follows laws, regulations, standards, and internal policies that apply to its operations and data handling.
Key term
Defender for Cloud
Microsoft Defender for Cloud is a cloud security posture management (CSPM) and cloud workload protection platform (CWPP) that provides unified security management and threat protection across hybrid and multi-cloud environments.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.