After one critical CVE is patched on a lock-lab virtual machine, the director expects Secure Score to jump immediately. How should the Azure security engineer explain the relationship?
Select an answer to reveal the explanation.
Short Explanation
Closing one CVE shrinks exposure—it does not magically add ten Secure Score points on the hour. Score moves when the related recommendation or control flips healthy.
Full Explanation
After one critical CVE is patched on a lock-lab virtual machine, explain that Microsoft Defender Vulnerability Management remediation reduces vulnerability exposure, while Secure Score moves when the related security recommendation or control becomes healthy. Closing a single CVE is not a fixed, immediate Secure Score point grant.
Claiming every closed MDVM CVE always raises Secure Score by a fixed ten points the same hour invents a scoring contract that does not exist. Saying Secure Score ignores security recommendations and only tracks patched CVEs one-for-one reverses how Secure Score aggregates controls. Claiming that patching any CVE disables Secure Score until the next billing cycle invents a billing side effect unrelated to recommendation health.
Exam caveat: civic directors often equate “patched” with “score jumped”; engineers should set expectations that exposure reduction and Secure Score are related but not tick-for-tick identical metrics.
Operational check: after the CVE is closed, review whether any related Defender for Cloud recommendation or Secure Score control changed state; report exposure reduction immediately and Secure Score impact only after recommendation health updates.