Task 3.1: Design solutions for security posture management in hybrid and multicloud environments

• AMore MCSB recommendations in Foundational CSPM

  Incorrect

  Foundational CSPM gives recommendations and a secure score but no attack path analysis.

• BThe Defender CSPM plan, for attack path analysis and risk prioritization

  Correct

  Attack path analysis and risk prioritization are Defender CSPM capabilities beyond Foundational CSPM.

• CAzure Advisor's security recommendations

  Incorrect

  Advisor surfaces best-practice recommendations, not attack paths across clouds.

• DA weekly export of the secure score to Power BI

  Incorrect

  A score export doesn't show how weaknesses chain together.

Foundational CSPM is free and provides MCSB-based recommendations and the secure score. The paid Defender CSPM plan adds advanced posture features such as AI security posture, attack path analysis and risk prioritization.

• ADelegate the AWS accounts to Azure through Azure Lighthouse

  Incorrect

  Lighthouse delegates Azure resources between Entra tenants, not AWS accounts.

• BInstall the legacy Log Analytics agent on the on-premises servers and report them to a Defender for Cloud workspace

  Incorrect

  The legacy agent is retired and isn't how servers are onboarded today.

• CDeploy the Azure Monitor Agent to the on-premises servers and send their data to the workspace Defender for Cloud uses

  Incorrect

  Defender for Servers no longer uses the Azure Monitor Agent for most plan features; machines outside Azure are connected through Azure Arc.

• DConnect the AWS accounts to Defender for Cloud with the AWS connector

  Correct

  The AWS connector brings AWS resources into Defender for Cloud for posture and workload protection.

• EOnboard the on-premises servers to Azure Arc so Defender for Servers can protect them

  Correct

  Arc-enabled servers appear as Azure resources, so Defender for Cloud can assess and protect them.

Defender for Cloud connects AWS accounts through an AWS connector and GCP projects through a GCP connector. Machines outside Azure, such as on-premises servers, are connected through Azure Arc so that they're managed as Azure resources and covered by Defender for Servers.

• AOne team forgot to refresh the score, which updates only once a month

  Incorrect

  Scores are recalculated far more often than monthly.

• BTwo different models: the risk-based Cloud Secure Score and the classic secure score

  Correct

  Defender for Cloud offers two secure score models with different calculations; the new one weighs asset risk factors and criticality.

• CThe Defender portal score includes only on-premises servers

  Incorrect

  That isn't how the Cloud Secure Score is scoped.

• DThe Azure portal score counts custom policy definitions too, which always lower the score compared with the Defender portal

  Incorrect

  Only built-in MCSB recommendations affect the classic secure score.

Defender for Cloud offers two secure score models. The new Cloud Secure Score, available in the Microsoft Defender portal, is risk-based and incorporates asset risk factors and criticality. The classic secure score remains in the Azure portal. They use different calculations, so the numbers differ. Only built-in MCSB recommendations affect the classic score.

• ADefender for Cloud's AWS and GCP connectors

  Incorrect

  Connectors cover accounts you already know about, not unknown assets on the internet.

• BMicrosoft Defender External Attack Surface Management

  Correct

  Defender EASM continuously discovers and maps internet-facing infrastructure, starting from assets you know, such as your domains.

• CAzure Resource Graph queries across subscriptions

  Incorrect

  Resource Graph sees only resources inside Azure subscriptions.

• DDefender for Endpoint device discovery on the corporate network

  Incorrect

  Device discovery finds devices on internal networks, not forgotten internet properties.

Microsoft Defender External Attack Surface Management continuously discovers and maps your digital attack surface to give an external view of your online infrastructure. Its discovery starts from known legitimate assets and recursively finds connected infrastructure to uncover previously unknown and unmonitored properties.

• AThe count of open incidents in Defender XDR each month

  Incorrect

  Incidents measure attacks that happened, not exposure.

• BDefender for Cloud's classic secure score in the Azure portal, reported monthly with a trend line for each subscription

  Incorrect

  That score covers cloud resources only and isn't focused on one threat area.

• CA quarterly penetration test report

  Incorrect

  A point-in-time test doesn't give a monthly, multi-domain exposure measure.

• DA security initiative in Exposure Management, with a target score and its metrics

  Correct

  Initiatives give a metric-driven way to track exposure in a specific area, with scores, target scores, trends and recommendations.

Microsoft Security Exposure Management offers security initiatives as a focused, metric-driven way of tracking exposure in specific security areas. You can view initiative scores, set target scores, check trends and review the associated metrics and recommendations.

• AOnce a month

  Incorrect

  It's recalculated much more often.

• BEvery eight hours

  Correct

  Each control is calculated every eight hours.

• COnly when an administrator clicks refresh

  Incorrect

  Calculation is automatic.

• DEvery five seconds

  Incorrect

  That isn't the schedule.

Defender for Cloud calculates each secure score control every eight hours for each Azure subscription or each AWS or GCP cloud connector.

• AA standalone Defender for DNS plan purchased separately

  Incorrect

  Only existing subscribers keep the standalone plan.

• BThe Defender CSPM plan's posture recommendations

  Incorrect

  Posture recommendations don't include DNS threat alerts.

• CMicrosoft Secure Score

  Incorrect

  Secure Score measures posture; it doesn't raise DNS threat alerts.

• DDefender for Servers Plan 2

  Correct

  For new subscriptions, DNS alerts are included in Defender for Servers Plan 2.

Since August 1, 2023, existing Defender for DNS customers can keep the standalone plan, while for new subscriptions alerts about suspicious DNS activity are included in Defender for Servers Plan 2.

• AAttack paths

  Incorrect

  Attack paths are chains of weaknesses.

• BWatchlists

  Incorrect

  Watchlists are a Sentinel feature.

• CConnectors

  Incorrect

  Connectors attach cloud accounts to Defender for Cloud.

• DDiscovery seeds

  Correct

  Known legitimate assets used to start discovery are called discovery seeds.

Defender EASM discovery recursively searches for infrastructure through observed connections to known legitimate assets, called discovery seeds.

• AA unified view of posture across endpoints, cloud and external surfaces

  Correct

  Exposure Management unifies posture and exposure data across workloads.

• BA replacement for Microsoft Entra ID sign-in logs and audit logs, stored in the Defender portal

  Incorrect

  It doesn't replace identity logs.

• CEmail filtering for phishing

  Incorrect

  That's Defender for Office 365.

• DBackup of business-critical data

  Incorrect

  That's a backup service.

Microsoft Security Exposure Management provides a unified view of security posture across company assets and workloads, spanning endpoints, cloud resources and external attack surfaces.