Task 4.1: Manage security posture by using Defender for Cloud

• AConnect each of the 120 member accounts individually, which is the only way to cover an organization

  Incorrect

  Management account onboarding covers member accounts and new ones automatically.

• BConnect the delegated administrator account instead of the management account, which then provisions all member accounts

  Incorrect

  Delegated administrator accounts aren't supported for organization onboarding.

• CConnect any one member account and enable organization discovery in its connector

  Incorrect

  A member account connector covers only that account.

• DConnect the AWS management account, which auto-provisions connectors for current and future member accounts

  Correct

  Only the management account can onboard the organization.

To onboard an AWS organization, create a connector for the AWS management account; delegated administrator accounts aren't supported. Auto provisioning then creates connectors for discovered member accounts and for accounts created later. The management account deploys a CloudFormation StackSet, which needs trusted access for AWS Organizations.

• ALabel them Monitor Only

  Incorrect

  Monitor Only is for related assets that the company doesn't control.

• BLabel them Dependency

  Incorrect

  Dependency is for third-party infrastructure that supports your assets.

• CAdd them as new discovery seeds and leave their state unchanged

  Incorrect

  Seeds guide discovery but don't change how existing assets are treated.

• DChange their state to Approved Inventory

  Correct

  Approved Inventory assets are scanned daily and appear in dashboard charts by default.

Defender EASM asset states drive how assets are processed. Approved Inventory is your owned attack surface: always included in dashboard charts and scanned daily. Candidate and Requires Investigation assets need manual review of ownership, while Dependency and Monitor Only separate third-party and related assets for reporting.

• AExtend the existing exception by 14 days

  Incorrect

  Exception durations can't be extended.

• BCreate a new exception with the needed duration and scope when the current one ends

  Correct

  A new exception is the documented way to continue past expiry.

• CCancel the exception, which converts it to a permanent one

  Incorrect

  Cancelling ends the exception.

• DMove the servers to a device group without recommendations

  Incorrect

  Recommendations follow the software, not an empty device group.

In Defender Vulnerability Management, an exception for a recommendation or CVE has a justification, a duration and a scope (global or by device group). Exception durations can't be extended; if an exception must continue after it expires, create a new one with the required duration and scope.

• AUse Block from the tool's security recommendation in Defender Vulnerability Management

  Correct

  Blocking creates file indicators for the vulnerable version's executables, which Defender Antivirus blocks.

• BUse Warn from the recommendation

  Incorrect

  The requirement is to stop the version from running, not to discourage it.

• CCreate a recommendation exception until the patch is ready

  Incorrect

  An exception hides the finding; it doesn't stop the app from running.

• DUninstall the tool with a Defender for Endpoint live response script on each server

  Incorrect

  Removing the tool also removes the patched version's functionality and isn't the built-in mitigation.

From a security recommendation, Defender Vulnerability Management can block or warn on vulnerable versions of an app as a temporary mitigation. Block creates file-hash indicators for each executable in those versions, and Microsoft Defender Antivirus blocks them, usually within minutes but up to three hours. It's a premium capability, included in Defender for Servers Plan 2.

• AMove the domain to Azure DNS, which dangling DNS detection requires

  Incorrect

  Detection works with Azure DNS and with external registrars.

• BRecreate the app on a Windows plan, which detection covers

  Incorrect

  Dangling DNS protection applies to App Service on both Windows and Linux.

• CWait for the plan's first scan of the registrar's existing records

  Incorrect

  Defender for Cloud doesn't scan your registrar for existing dangling entries.

• DDelete the leftover record yourself; no alert will come for it

  Correct

  The plan alerts when a site it has monitored is decommissioned with its DNS entry left; a site deleted before the plan was on won't be flagged.

Defender for App Service identifies DNS entries left at a registrar when an App Service website is decommissioned, which are vulnerable to subdomain takeover. It doesn't scan the registrar for existing dangling entries: it alerts when a site is decommissioned and its custom domain isn't deleted. It might not alert if the custom domain doesn't point directly to an App Service resource or if it hasn't monitored traffic to the site since the protection was enabled. It works with Azure DNS or external registrars, on Windows and Linux.

• AA workflow automation triggered by that recommendation

  Correct

  Workflow automations run Logic Apps when recommendations, alerts or compliance results change.

• BContinuous export of the recommendation to an event hub

  Incorrect

  Exporting sends data but doesn't start the ticket workflow by itself.

• CAn Azure Policy remediation task

  Incorrect

  Remediation tasks fix resources; they don't open tickets.

• DA governance rule with an email notification only

  Incorrect

  Email notifications don't open a ticket in the ticketing system.

Workflow automation in Defender for Cloud triggers Azure Logic Apps when security alerts, recommendations or regulatory compliance assessments change, so that you can automate responses such as opening tickets or notifying owners.

• AEvery 15 minutes or every hour

  Incorrect

  The options are longer.

• BOnly every 24 hours

  Incorrect

  You can pick shorter intervals too.

• CEvery 4, 6, 12 or 24 hours

  Correct

  These are the selectable intervals; some collectors run on fixed schedules.

• DOnce a week

  Incorrect

  Weekly isn't an option.

When you create an AWS or GCP connector, you select an interval to scan the environment every 4, 6, 12 or 24 hours. Some data collectors run with fixed intervals that the setting doesn't affect.

• AUnder Exposure Management > Vulnerability Management

  Correct

  MDVM now sits under Exposure Management for cloud and device environments.

• BUnder Endpoints > Vulnerability management, as before

  Incorrect

  That was the earlier location; it moved under Exposure Management.

• CUnder Settings > Microsoft Sentinel

  Incorrect

  That configures Sentinel, not vulnerability management.

• DOnly in the Azure portal

  Incorrect

  It's in the Defender portal.

Microsoft Defender Vulnerability Management is now under Exposure Management and supports both cloud and device environments; vulnerability scanning results are at Exposure Management > Vulnerability Management in the Defender portal.

• ASevere, Moderate and Minor

  Incorrect

  Those aren't the risk level names.

• BCritical, High, Medium, Low and Not evaluated

  Correct

  These are the documented risk level classifications.

• CRed, Amber and Green

  Incorrect

  Risk levels aren't colors.

• D1 to 10

  Incorrect

  Risk levels aren't numeric scores.

Defender for Cloud's risk prioritization classifies recommendations as Critical, High, Medium, Low or Not evaluated, based on risk factors such as exploitability and business impact.

• AReader on the subscription

  Incorrect

  Reader can't create the connector.

• BContributor on the Azure subscription

  Correct

  Contributor-level permission on the subscription is required.

• CGlobal Administrator in Microsoft Entra ID

  Incorrect

  An Entra role isn't the requirement.

• DSecurity Reader on the subscription

  Incorrect

  Security Reader is read-only.

To connect a GCP project or organization, you need Defender for Cloud enabled on the Azure subscription, Contributor-level permission on that subscription, and access to the GCP project or organization.