SC-900 Practice Question: Describe the capabilities of Microsoft security solutions

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Regulatory compliance dashboard

  Why this is correct

  The Regulatory compliance dashboard in Microsoft Defender for Cloud provides a centralized view of an organization's compliance posture against various industry standards and regulatory benchmarks, such as CIS, NIST, and PCI DSS. It continuously assesses the environment, mapping security controls to specific requirements within these frameworks and clearly indicating which controls pass or fail. This dashboard is specifically designed to help organizations understand and improve their adherence to external regulations by offering actionable recommendations and detailed compliance reports.

• ✗

  Secure Score

  Why it's wrong here

  Secure Score in Microsoft Defender for Cloud quantifies an organization's security posture as a numerical value, based on security recommendations. While improving the Secure Score enhances overall security and indirectly contributes to compliance, its primary function is to provide a prioritized list of actions to reduce risk, not to directly assess or report against specific regulatory compliance frameworks. It focuses on security hygiene rather than direct regulatory mapping.

  When this WOULD be correct

  A security administrator wants to quickly assess the overall security posture of Azure resources and identify recommendations to improve it, without needing compliance details for specific standards.

• ✗

  Azure Policy

  Why it's wrong here

  Azure Policy is a powerful governance service used to create, assign, and manage policies that enforce rules and effects over resources to ensure they comply with corporate standards and service level agreements. While it can enforce configurations that align with compliance requirements and audit for non-compliance, Azure Policy itself does not offer a consolidated dashboard for assessing an organization's overall adherence to external regulatory standards. It's an enforcement engine, not a compliance reporting tool.

  When this WOULD be correct

  An administrator needs to enforce specific security configurations (e.g., require encryption on storage accounts) across all Azure resources. In this scenario, Azure Policy would be the correct answer because it allows creating and assigning policies to audit or enforce compliance rules.

• ✗

  Microsoft Sentinel

  Why it's wrong here

  Microsoft Sentinel is a cloud-native Security Information and Event Management (SIEM) and Security Orchestration, Automation, and Response (SOAR) solution that provides intelligent security analytics and threat intelligence across the enterprise. Its core purpose is to collect security data, detect threats, investigate incidents, and automate responses. While Sentinel can ingest data relevant to security audits, it is not designed to provide a high-level, continuous assessment of an organization's adherence to specific regulatory compliance frameworks.

  When this WOULD be correct

  A security team needs to centralize security logs and alerts from multiple sources, detect threats, and automate incident response across the enterprise environment.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SC-900 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official SC-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”