Task 3.2: Describe security management capabilities of Azure

• ASecurity information and event management (SIEM)

  Incorrect

  SIEM is what Microsoft Sentinel provides.

• BCloud security posture management (CSPM)

  Correct

  CSPM is one of Defender for Cloud's three pillars, with DevSecOps and CWPP.

• CCloud workload protection platform (CWPP)

  Correct

  CWPP, delivered through Defender plans for servers, containers, storage and databases, is one of the pillars.

• DCloud access security broker (CASB)

  Incorrect

  A CASB is what Microsoft Defender for Cloud Apps provides.

• EIdentity threat detection and response (ITDR)

  Incorrect

  ITDR is what Microsoft Defender for Identity delivers.

Defender for Cloud covers Azure, other clouds and on-premises resources. It combines a DevSecOps solution for security at the code level, a cloud security posture management (CSPM) solution that surfaces actions to prevent breaches, and a cloud workload protection platform (CWPP) with protections for servers, containers, storage, databases and other workloads.

• AThe score improves only after every one of those recommendations is remediated for that resource

  Correct

  Recommendations are grouped into controls, and the score improves only when all recommendations for a single resource within a control are remediated.

• BThe score is recalculated only once a month

  Incorrect

  The score reflects continuous assessment; waiting for a monthly run isn't the reason here.

• COnly high-severity recommendations count toward the score

  Incorrect

  Severity helps prioritize, but the score is built from security controls, not from high-severity items alone.

• DSecure score needs the paid Defender CSPM plan

  Incorrect

  Secure score is part of the free foundational CSPM capabilities.

Secure score aggregates Defender for Cloud's findings into one number: the higher the score, the lower the identified risk. Recommendations are grouped into security controls, logical groups that reflect vulnerable attack surfaces, and the score only improves when all of the recommendations for a single resource within a control are remediated.

• AThe Defender CSPM plan

  Incorrect

  Defender CSPM adds advanced posture management such as attack paths; runtime threat alerts for servers come from a workload plan.

• BThe Microsoft cloud security benchmark initiative

  Incorrect

  The benchmark is assigned by default and drives recommendations, not threat alerts.

• CDefender for Storage

  Incorrect

  Defender for Storage protects storage accounts, not virtual machines.

• DThe Defender for Servers plan

  Correct

  CWPP is delivered through Defender plans per resource type, and they raise security alerts when workloads are threatened.

Defender for Cloud delivers cloud workload protection through Microsoft Defender plans specific to resource types, such as Defender for Servers, Defender for Storage or Defender for Databases. When the environment is threatened, security alerts indicate the nature and severity of the threat so that the team can plan its response.

• ASecure score

  Incorrect

  Secure score aggregates findings into one number; it doesn't show how issues chain toward a resource.

• BAttack path analysis

  Correct

  Attack path analysis models how an attacker could chain vulnerabilities to reach high-value resources, so the combination can be prioritized.

• CThe regulatory compliance dashboard

  Incorrect

  The dashboard shows status against standards such as ISO 27001, not routes an attacker could take.

• DSecurity alerts from Defender for Servers

  Incorrect

  Alerts report threats that are happening, not potential paths between misconfigurations.

Attack path analysis, part of the Defender CSPM plan, helps teams understand how an attacker might chain vulnerabilities to reach high-value resources. For example, it can reveal that an internet-exposed VM with a known vulnerability has access to a storage account with sensitive data, so the combination is fixed rather than each issue in isolation.

• ADevOps security in Microsoft Defender for Cloud

  Correct

  Defender for DevOps gives security teams a central console with findings from code, secrets and open-source dependency scans across pipelines.

• BData security posture management in Defender CSPM

  Incorrect

  DSPM discovers datastores with sensitive data and assesses their exposure; it doesn't scan code repositories.

• CDefender for Storage

  Incorrect

  Defender for Storage protects storage accounts against threats; it doesn't review repositories.

• DApp connectors for the DevOps platforms in Defender for Cloud Apps

  Incorrect

  App connectors give visibility into accounts, user and admin activity in the connected apps; they don't scan the code inside repositories.

Defender for DevOps, a service in Defender for Cloud, lets security teams manage DevOps security across multi-pipeline environments such as GitHub, Azure DevOps and GitLab. Its overview surfaces code scanning vulnerabilities, exposed secrets, open-source dependency vulnerabilities and recommendations, so issues are caught before production.

• AOnly a pass or fail flag for the subscription

  Incorrect

  Recommendations go further, with steps, affected resources and severity.

• BA list of users who signed in to the affected resources

  Incorrect

  Sign-in activity isn't part of a recommendation.

• CThe issue, how to fix it, the affected resources and its severity

  Correct

  Each recommendation includes a description, remediation steps, affected resources, severity and risk factors.

• DAn automatic fix that Defender for Cloud has already applied to each resource

  Incorrect

  Recommendations guide remediation; they aren't fixes already applied.

Each Defender for Cloud recommendation provides a short description of the security issue, remediation steps, the affected resources, severity and risk factors, and attack path context when available.

• AIt replaces CIS and NIST, so their controls no longer apply

  Incorrect

  The benchmark builds on those frameworks rather than replacing them.

• BIt applies only to Azure, with no guidance for other clouds

  Incorrect

  The benchmark also gives implementation guidance for AWS and GCP.

• CIt's a Microsoft certification that auditors issue to customers

  Incorrect

  It's a Microsoft-authored set of guidelines, not a certification.

• DIt builds on CIS and NIST controls and maps its recommendations to CIS, NIST and PCI DSS

  Correct

  The mapping makes security and compliance simpler for organizations already working with those frameworks.

The Microsoft cloud security benchmark is a Microsoft-authored set of security and compliance guidelines for Azure and multicloud environments. It builds on controls from the Center for Internet Security (CIS) and NIST, maps recommendations to frameworks including CIS, NIST and PCI DSS, and provides Azure, AWS and GCP guidance.

• AAzure Key Vault

  Incorrect

  Key Vault doesn't define or evaluate resource policies.

• BAzure Policy

  Correct

  Defender for Cloud's security policies are backed by Azure Policy, Microsoft's governance service for organizational rules.

• CMicrosoft Sentinel

  Incorrect

  Sentinel is a SIEM and SOAR solution, not a policy engine for resource configuration.

• DMicrosoft Purview Compliance Manager

  Incorrect

  Compliance Manager tracks regulatory controls and improvement actions, not Azure resource policies.

Security policies in Microsoft Defender for Cloud are backed by Azure Policy, Microsoft's governance service for enforcing organizational rules across Azure resources. Azure Policy offers many built-in policy definitions, and organizations can also create custom ones.

• AThe Cloud apps node

  Incorrect

  The Cloud apps node holds Defender for Cloud Apps functionality.

• BThe Cloud security node

  Correct

  The Cloud security node gives access to Defender for Cloud, with a Cloud Overview dashboard as its landing page.

• CThe Identities node

  Incorrect

  That node maps to Defender for Identity.

• DThe Endpoints node

  Incorrect

  That node maps to Defender for Endpoint.

Defender for Cloud is integrated into the Microsoft Defender portal. Its Cloud security node opens on the Cloud Overview dashboard, with security at a glance (cloud secure score, alerts by severity, coverage), top actions and trends across Azure, AWS and GCP.