Describe the capabilities of Microsoft security solutions →mediumMultiple Select

SC-900 Practice Question: Describe the capabilities of Microsoft security solutions

Your organization uses Microsoft Defender for Cloud to assess the security posture of its Azure resources. Which two actions can be taken to improve the Secure Score? (Choose two.)

⚠ Common exam trap

Test-takers frequently confuse operational security actions (like deleting resources or disabling VMs) with the specific security controls and recommendations that directly influence the Secure Score calculation.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Implement security recommendations by remediating unhealthy resources

Option C is correct because Microsoft Defender for Cloud's Secure Score is calculated from the percentage of passed security assessments (recommendations) versus total applicable assessments, so remediating unhealthy resources to implement recommendations directly raises the score. Option E is correct because enabling Defender for Cloud plans (such as Defender for Servers, Storage, Containers, etc.) activates additional security assessments and recommendations for those resource types, increasing the number of controls that contribute to and can improve the Secure Score. Option A is not correct because simply deleting unused resources is not a Secure Score control; the score improves through remediation of specific recommendations, not general cleanup. Option B is not correct because disabling diagnostic logging for storage accounts removes a security control and would lower, not raise, the Secure Score. Option D is not correct because powering off non-critical VMs is not a Defender for Cloud recommendation that increases the Secure Score and does not remediate an unhealthy assessment.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Delete unused Azure resources to simplify management
Why it's wrong here
Deleting unused Azure resources, while beneficial for cost management and operational simplicity, does not directly improve Microsoft Defender for Cloud's Secure Score. The Secure Score is calculated based on the security posture of active, monitored resources and the remediation of identified security recommendations. Removing a resource simply removes it from the assessment scope; it doesn't address or remediate security findings on remaining resources, and if the deleted resource was well-configured, its removal might even slightly impact the overall score calculation by altering the baseline.
✗
Disable diagnostic logging for storage accounts
Why it's wrong here
Disabling diagnostic logging for storage accounts is a detrimental action that would negatively impact, rather than improve, the Secure Score. Diagnostic logging is a fundamental security control recommended by Microsoft Defender for Cloud, providing crucial audit trails and operational insights necessary for detecting suspicious activities and investigating security incidents. Removing this capability would create a significant security gap, directly leading to a lower Secure Score by failing to meet essential monitoring and compliance recommendations.
✓
Implement security recommendations by remediating unhealthy resources
Why this is correct
Implementing security recommendations by remediating unhealthy resources is the most direct and effective method for improving Microsoft Defender for Cloud's Secure Score. The Secure Score is a quantitative measurement derived from the successful completion of security recommendations across various controls. By actively addressing and resolving identified vulnerabilities, misconfigurations, and compliance gaps on resources flagged as "unhealthy," organizations directly fulfill the criteria for these controls, thereby increasing their overall security posture and elevating the Secure Score.
✗
Disable non-critical virtual machines to reduce attack surface
Why it's wrong here
Disabling non-critical virtual machines, while potentially reducing the overall attack surface by taking them offline, does not directly contribute to an improvement in Microsoft Defender for Cloud's Secure Score. The Secure Score primarily evaluates the security configuration and posture of active, operational resources against a set of security recommendations. Simply disabling a VM does not remediate any underlying security misconfigurations or vulnerabilities that would be present if the machine were re-enabled, nor does it fulfill specific active security recommendations that contribute to the score.
✓
Enable Microsoft Defender for Cloud plans for all supported resource types
Why this is correct
Enabling Microsoft Defender for Cloud plans for all supported resource types significantly enhances an organization's security posture and directly improves the Secure Score. These advanced plans (e.g., Defender for Servers, Defender for Storage, Defender for SQL) extend comprehensive threat protection, vulnerability assessments, and security monitoring capabilities to a broader range of Azure resources. By activating these plans, organizations gain more granular security recommendations and automated protections, which directly contribute to meeting more security controls and thus increasing the Secure Score.

Go deeper

SC-900 Practice Question: Describe the capabilities of Microsoft security solutions

Why each option matters

Option-by-option breakdown

Related to this question