AZ-500 Question 218
Select 2Your organization has noticed that the Microsoft Defender for Cloud secure score is critically low across multiple Azure subscriptions. You have been tasked with using the Defender for Cloud Inventory to identify resources with the most urgent security issues and prioritize remediation steps that will provide the greatest boost to the secure score. Which two actions should you take first to effectively identify and address these recommendations? (Choose two.)
- A
Filter the Inventory for critical and high-severity recommendations, then review which recommended actions will have the greatest impact on the secure score.
- B
Immediately enable all optional recommendations for all resources, regardless of severity level, without reviewing their effect on the secure score.
- C
Focus on any recommendations that were created earliest, as they are always the highest priority for secure score improvements.
- D
Open high-impact recommendations directly from the Inventory and remediate them in order of their secure score contribution.
Show answer and explanation
Correct answers: A, D
Explanation
By focusing on high-severity recommendations and those with the greatest effect on the secure score, you can maximize security improvements in the shortest time. The Microsoft Defender for Cloud Inventory blade highlights issues and their urgency, aiding in prioritization. Filtering for critical threats and then remediating items with the highest score impact is aligned with Microsoft best practices to improve Azure security posture quickly. Refer to the Microsoft Defender for Cloud documentation (https://learn.microsoft.com/azure/defender-for-cloud) for more details on secure score, prioritizing recommendations, and using the Inventory effectively.
- A. Correct.
Correct. Filtering by critical or high-severity issues helps you see the most urgent problems. In Defender for Cloud, recommendations with the greatest impact on your secure score typically address critical risks. Reviewing these first ensures maximum improvement to overall security posture.
- B. Incorrect.
Incorrect. Enabling every recommendation (especially optional or informational ones) without considering severity or secure score impact may waste time and resources without significantly raising the score. It's more efficient to prioritize actions based on their security and score impact.
- C. Incorrect.
Incorrect. The age of a recommendation does not necessarily reflect its severity or impact on the secure score. A recent high-severity issue can pose a greater risk than an older, low-severity recommendation.
- D. Correct.
Correct. Opening recommendations directly from the Inventory allows prioritization based on secure score contribution. Addressing the highest-impact items first is recommended best practice to quickly increase the secure score.