During a security review an administrator is asked to show which hardening settings on a production instance are weaker than the recommended configuration, and to show the evidence rather than an opinion. Which capability of Security Center produces that evidence?
- AThe instance scan that inspects configuration records for coding standards and flags scripts that use inefficient query patterns
- BThe system log search that returns authentication failures over a chosen period and groups them by the account that produced them
- CThe update set preview that compares the configuration captured on the instance against the payload of a retrieved update set before commit
- DThe hardening compliance view that evaluates the instance against recommended security settings and lists each control with its current result Correct
Why A is wrong: Scanning configuration for quality problems is a real platform capability and sounds close enough to tempt, but it examines development practice rather than reporting the instance security posture against hardening recommendations.
Why B is wrong: Failed login records are genuine security evidence and administrators do review them, but they describe events that have already happened rather than which settings deviate from the recommended hardening configuration.
Why C is wrong: Preview genuinely reports differences before a commit, which makes comparison language feel right, but it compares an update set payload with the instance and knows nothing about security recommendations.
Why D is correct: Security Center evaluates the instance against a published set of hardening recommendations and presents each control with a pass or fail result, which is precisely the evidence a reviewer is asking to see.