Manage Security Posture by Using Microsoft Defender for Cloud AZ-500 Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   A company needs to demonstrate compliance with PCI DSS. Which Microsoft Defender for Cloud feature would provide a compliance assessment for this standard?

   • AInventory
   • BSecure Score
   • CCompliance
   • DSecurity alerts
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   Your company must demonstrate compliance with the CIS Microsoft Azure Foundations Benchmark. You have enabled the CIS standard in Microsoft Defender for Cloud, but the compliance dashboard shows several controls as 'Not started' even though your resources appear to meet the requirements. What is the most likely cause?

   • AThe resources are exempted from the recommendations.
   • BThe corresponding recommendations have not been evaluated because the resources are not covered by the standard.
   • CThe assessments for those controls have not yet been run or the resources were recently added.
   • DThe standard is not assigned at the subscription level.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   Your company uses both Azure and Google Cloud Platform (GCP). You need to assess GCP resources against the CIS GCP benchmark using Microsoft Defender for Cloud. What should you do?

   • AExport GCP security findings to Azure Sentinel.
   • BConnect your GCP project to Defender for Cloud and enable the CIS GCP standard.
   • CUse Azure Arc to onboard GCP VMs.
   • DCreate a custom standard for GCP resources.
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   A company has connected AWS to Defender for Cloud and enabled Defender for Servers for the AWS connector. They notice that the Secure Score for AWS resources is lower than expected. They have already remediated all recommendations shown for AWS resources. What could be the reason for the lower score?

   • AThe AWS resources are not contributing to the Secure Score because they are not in the same management group.
   • BThe Secure Score is lower because AWS resources have inherently more security risks.
   • CThe Secure Score is calculated differently for AWS resources than for Azure resources.
   • DThe AWS connector is not configured to collect data from all AWS regions, so some resources are not assessed.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A company wants to proactively identify exposed assets and potential attack surfaces on the internet, such as open ports and misconfigured domains, before attackers exploit them. They have Microsoft Defender for Cloud enabled. Which feature should they use to continuously monitor their external attack surface?

   • AEnable the 'Defender for Cloud' 'Inventory' feature to list all public IP addresses and open ports.
   • BCreate a custom compliance standard that includes external attack surface controls.
   • CUse the Secure Score recommendations to identify all internet-facing resources and manually review them.
   • DEnable Microsoft Defender External Attack Surface Management (EASM) and configure it to scan the organization's known infrastructure.
   Reveal Solution Discussion Select an answer first