SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
A healthcare organization runs a mix of workloads on Azure (Azure VMs, SQL Database) and on-premises (Windows Servers). They must continuously assess their compliance against the HIPAA and HITRUST regulatory frameworks. They want a unified dashboard that shows their compliance score against these standards and provides step-by-step recommendations to remediate violations. Which Microsoft Defender for Cloud capability should they use?
⚠ Common exam trap
Many exam-takers confuse the Secure score (which measures general security hygiene) with the Regulatory compliance dashboard (which measures adherence to specific regulatory frameworks), leading them to select Secure score when the question explicitly asks for compliance against HIPAA and HITRUST.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Regulatory compliance dashboard
The Regulatory compliance dashboard in Microsoft Defender for Cloud provides a unified view of an organization's compliance posture against specific regulatory standards like HIPAA and HITRUST. It displays a compliance score for each selected framework and offers step-by-step remediation recommendations for identified violations, directly meeting the requirement for continuous assessment and guided remediation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Regulatory compliance dashboard
Why this is correct
The Regulatory compliance dashboard, a core feature of Microsoft Defender for Cloud, provides a centralized view to manage and track an organization's compliance posture against various regulatory standards. It allows users to add built-in standards like HIPAA and HITRUST, crucial for healthcare organizations, and continuously monitors the environment, mapping security recommendations to specific controls within these frameworks. This dashboard presents a compliance score and actionable recommendations, enabling organizations to efficiently demonstrate adherence to industry-specific regulations.
- ✗
Secure score
Why it's wrong here
Secure Score in Microsoft Defender for Cloud quantifies an organization's overall security posture by evaluating the implementation of security recommendations across Azure, hybrid, and multi-cloud environments. While it provides a valuable metric for improving general security hygiene and reducing attack surface, it primarily focuses on best practices and does not directly map to or report against specific regulatory frameworks such as HIPAA or HITRUST. Therefore, it cannot be used to directly demonstrate adherence to these industry-specific compliance standards.
- ✗
Microsoft Defender for Cloud Apps
Why it's wrong here
Microsoft Defender for Cloud Apps functions as a Cloud Access Security Broker (CASB), providing visibility, control, and threat protection for an organization's cloud applications and services, particularly SaaS offerings. Its primary role involves discovering shadow IT, protecting sensitive data within cloud apps, and detecting anomalous user behavior. While critical for SaaS security, it does not directly assess or report on the regulatory compliance status of Azure infrastructure workloads or on-premises resources against standards like HIPAA.
- ✗
Microsoft Defender for Servers
Why it's wrong here
Microsoft Defender for Servers is a specific plan within Defender for Cloud that delivers advanced threat protection and security capabilities tailored for server workloads, whether they are hosted in Azure, on-premises, or in other cloud environments. It offers features like endpoint detection and response (EDR), vulnerability assessment, file integrity monitoring, and just-in-time VM access. While crucial for securing individual servers, this plan itself does not encompass the comprehensive regulatory compliance dashboard needed to track and report against industry standards like HIPAA or HITRUST across an entire environment.
Go deeper
Related to this question
Learn chapter
Compliance Concepts
Key term
General Data Protection Regulation
A European Union law that gives individuals control over their personal data and sets strict rules for how organizations collect, store, and process that data.
Key term
Defender for Cloud
Microsoft Defender for Cloud is a cloud security posture management (CSPM) and cloud workload protection platform (CWPP) that provides unified security management and threat protection across hybrid and multi-cloud environments.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.