SC-100 Certification Practice Question #59

Question

You have an Azure subscription that has Microsoft Defender for Cloud enabled.
You need to enforce ISO 27001:2013 standards for the subscription. The solution must ensure that noncompliant resources are remediated automatically.
What should you use?

Accepted Answer

The key requirement is **automatic remediation** of noncompliant resources. Azure Policy is the engine that both enforces ISO 27001:2013 (there is a built-in ISO 27001 policy initiative) and performs remediation through the `deployIfNotExists`/`modify` effects and remediation tasks. MS Learn's Defender for Cloud "Enforce" guidance states this directly: Enforce "lets you take advantage of the DeployIfNotExist effect in Azure Policy, and automatically remediate noncompliant resources." Azure Blueprints only deploys a consistent initial baseline (and ISO 27001 blueprint guardrails are themselves delivered *via Azure Policy*); it does not continuously remediate. The regulatory compliance dashboard only surfaces compliance status, and Azure RBAC controls access, neither of which remediates. Suggested Answer, the 27-vote community majority, and MS Learn all converge on A, with only a minority favoring Blueprints, so confidence is 90.

More SC-100 practice questions