AZ-500 Question 214
Select 2Your organization manages multiple Azure subscriptions that must comply with a set of regulatory and security requirements. You have been tasked with using Microsoft Defender for Cloud to unify security policies across these subscriptions, automatically apply built-in security recommendations, and prevent noncompliant resource deployments wherever possible. You also need to track these subscriptions’ compliance states through secure score. Which two actions should you perform to achieve these goals?
- A
Create a custom initiative with your organization's policies, assign it to each subscription, and enable the built-in recommendations in Microsoft Defender for Cloud.
- B
Assign the default Azure Security Benchmark initiative (ASC Default) at the root management group level and enable the Microsoft Defender for Cloud standard plan.
- C
Enable Just-In-Time VM Access for all newly deployed Windows and Linux VMs by default.
- D
Manually generate compliance reports for each subscription separately on a weekly basis.
- E
Enable an Azure Policy assignment with a 'Deny' effect for resources that do not meet the recommended security configurations.
Show answer and explanation
Correct answers: B, E
Explanation
To manage security posture effectively with Microsoft Defender for Cloud, you must leverage built-in initiatives like Azure Security Benchmark (ASC Default) and enforce them across all subscriptions. Assigning this initiative at the root management group level ensures that every subscription inherits the same security standards. In addition, enabling the Defender for Cloud standard plan provides deeper threat protection and a unified secure score. Setting Azure Policy to 'Deny' resource deployments that fail security checks blocks noncompliant resources at deployment time, ensuring continuous compliance. For further guidance, refer to the official Microsoft Defender for Cloud documentation on policy assignments and Azure Policy enforcement (https://learn.microsoft.com/azure/defender-for-cloud).
- A. Incorrect.
Option 1 is partially correct in principle, creating a custom initiative can help if you have unique organizational requirements. However, simply enabling built-in recommendations without assigning the main Azure Security Benchmark initiative to all subscriptions may miss essential default controls. This by itself does not ensure consistent enforcement across multiple subscriptions or automatically prevent noncompliant deployments.
- B. Correct.
Option 2 is correct. Assigning the built-in Azure Security Benchmark (ASC Default) initiative at the root management group level ensures consistent policy enforcement across all subscriptions within the hierarchy. Enabling the Microsoft Defender for Cloud standard plan then provides advanced threat protection and creates a unified view of the secure score and compliance posture for those subscriptions.
- C. Incorrect.
Option 3, enabling Just-In-Time VM Access, is important for reducing inbound attack exposure on virtual machines. However, JIT VM Access alone does not establish consistent policy enforcement across all subscriptions or handle compliance checks for non-VM resources. It is a helpful security feature but not sufficient to achieve the stated goal of unified policy management and compliance auditing.
- D. Incorrect.
Option 4, manually generating compliance reports on a weekly basis, does nothing to automate the enforcement of policy or prevent noncompliant resources from being deployed. It is a manual process and does not fulfill the requirement of applying policies and recommendations systematically to all subscriptions.
- E. Correct.
Option 5 is correct. Using Azure Policy with a 'Deny' effect for resources that do not meet the recommended security configurations will prevent noncompliant resource deployments. This complements the built-in initiative by enforcing additional security restrictions and ensuring that your environment remains compliant with Microsoft Defender for Cloud recommendations.