AZ-500 Question 216
Select 2You are the security engineer for an organization with multiple Azure subscriptions in a single tenant. You need to unify the management of security recommendations across these subscriptions while automatically enrolling new VMs in Microsoft Defender for Cloud’s recommended coverage. Which two actions should you take to meet these requirements?
- A
Enable Microsoft Defender for Servers at the management group level for all child subscriptions, and configure auto-provisioning in the Environment Settings of Microsoft Defender for Cloud.
- B
Enable Microsoft Sentinel at each subscription individually to unify and track security posture across all resources.
- C
Use the 'continuous export' feature to send security recommendations from each subscription to a centralized Log Analytics workspace for unified reporting.
- D
Assign the built-in 'Enable Microsoft Defender for Cloud' blueprint at the resource group level to automatically onboard new resources.
Show answer and explanation
Correct answers: A, C
Explanation
To manage security recommendations and automatically enroll new resources in Microsoft Defender for Cloud, you should enable the Defender for Cloud plan (e.g., Defender for Servers) at the management group level and configure auto-provisioning. Additionally, using the continuous export feature helps consolidate all recommendations in a single location. For more details, refer to Microsoft Defender for Cloud documentation on 'Manage multiple subscriptions and tenants' and 'Continuous export of recommendations.'
- A. Correct.
Option A is correct. Enabling Microsoft Defender for Servers at the management group level ensures that all child subscriptions inherit the coverage. Configuring auto-provisioning in the Environment Settings lets you automatically install the required agent or extension on any new VM, helping maintain a consistent security posture across subscriptions.
- B. Incorrect.
Option B is incorrect. Microsoft Sentinel is a SIEM solution that provides security analytics and threat intelligence, but it does not unify security posture recommendations for Defender for Cloud. Sentinel focuses on collecting and analyzing security-related data from various sources; it does not replace or unify the core security recommendations feature of Microsoft Defender for Cloud.
- C. Correct.
Option C is correct. The continuous export feature in Microsoft Defender for Cloud allows you to export security recommendations to a central Log Analytics workspace or Event Hub. This approach gives you a unified view of recommendations spanning multiple subscriptions and simplifies central reporting or integration with other tools.
- D. Incorrect.
Option D is incorrect. Although Azure Blueprints can deploy multiple resources and policies at scale, there is no built-in blueprint named 'Enable Microsoft Defender for Cloud' that automatically onboards all new resources for coverage. Also, applying it at the resource group level might leave some new subscriptions or resources outside the blueprint’s scope.