SC-100 Certification Practice Question #269

Question

Your company has an Azure subscription that uses Microsoft Defender for Cloud.

The company signs a contract with the United States government.

You need to review the current subscription for NIST 800-53 compliance.

What should you do first?

Accepted Answer

NIST SP 800-53 is delivered to Azure as a Regulatory Compliance built-in initiative (a policy set of many control-mapped policy definitions), not as a single policy definition. To review the subscription for NIST 800-53 compliance, you first assign that built-in initiative scoped to the subscription so its controls are evaluated and surface in the compliance dashboard. MS Learn states the regulatory compliance built-in initiatives map directly to NIST SP 800-53 compliance domains and controls, which eliminates a single policy definition (B). Reviewing the Azure security baseline (C) or enabling Defender plans (D) does not perform a NIST 800-53 review. Suggested Answer, the sole voted comment, and MS Learn all agree on A, with no credible dissent.

More SC-100 practice questions