SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
Your organization uses Microsoft Defender for Cloud to secure Azure resources. You need to ensure that all storage accounts have soft delete enabled to protect against accidental deletion. Which policy should you implement?
⚠ Common exam trap
Watch out — candidates often confuse Azure Policy (which enforces configuration rules) with Defender for Cloud recommendations (which only suggest security improvements without automatic enforcement), leading them to select option D.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Policy with a built-in policy for storage accounts
Azure Policy with a built-in policy for storage accounts is correct because it allows you to enforce organizational standards and assess compliance at scale. The built-in policy 'Storage accounts should have soft delete enabled' can be assigned to a subscription or resource group to automatically audit or remediate storage accounts that do not have soft delete configured, ensuring protection against accidental deletion.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure Blueprints
Why it's wrong here
Azure Blueprints are designed to define a repeatable set of Azure resources, policies, and role assignments, orchestrating their deployment consistently across environments. While a blueprint can include policy assignments, it does not actively enforce the individual settings or configurations of resources after their initial deployment. Its primary function is to standardize the deployment of environments, not to continuously monitor and enforce specific resource configurations like soft delete.
- ✓
Azure Policy with a built-in policy for storage accounts
Why this is correct
Azure Policy is the correct tool because it provides a robust system for defining, assigning, and managing standards for your Azure resources. It can evaluate resource configurations against defined rules and enforce compliance by preventing non-compliant deployments or remediating existing non-compliant resources. There are built-in policies specifically designed to audit or enforce settings like soft delete for storage accounts, ensuring continuous configuration enforcement across your subscriptions.
- ✗
Azure role-based access control (RBAC)
Why it's wrong here
Azure role-based access control (RBAC) is fundamentally about managing who can do what on Azure resources, defining permissions for users, groups, or applications. It controls management plane operations, such as creating, modifying, or deleting resources, but it does not dictate the intrinsic state or configuration of the resource itself. RBAC cannot enforce a specific setting like soft delete on a storage account; it only governs the ability to perform actions that might affect that setting.
- ✗
Defender for Cloud security recommendations
Why it's wrong here
Microsoft Defender for Cloud security recommendations are advisory in nature, providing actionable insights into potential vulnerabilities or misconfigurations within your Azure environment. While Defender for Cloud might recommend enabling soft delete for storage accounts to improve security posture, these recommendations are suggestions that require manual intervention or integration with other services for enforcement. They do not automatically enforce the suggested settings or prevent non-compliant configurations from being deployed.
Go deeper
Related to this question
Learn chapter
Compliance Concepts
Key term
Policy
A policy is a set of rules or guidelines that defines how an organization manages, secures, and operates its IT systems and services.
Key term
Audit
An audit is a systematic, independent review of IT systems, processes, and controls to verify compliance with policies, standards, and regulations.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.