After one critical CVE is patched on a lock-lab virtual machine, the director expects Secure Score to jump immediately. How should the Azure security engineer explain the relationship?
Select an answer to reveal the explanation.
Short Explanation
Closing one CVE shrinks exposure—it does not magically add ten Secure Score points on the hour. Score moves when the related recommendation or control flips healthy.
Full Explanation
Microsoft Defender Vulnerability Management reduces vulnerability exposure when findings are remediated. Secure Score changes when related Microsoft Defender for Cloud security recommendations or controls become healthy, not automatically one-for-one with every individual CVE closure on a fixed-point schedule. Claiming CVEs alone drive score, that score ignores recommendations, or that patching disables Secure Score misstates the relationship.