AZ-500 Question 219
Select 2You are an Azure security engineer at Contoso. While reviewing Microsoft Defender for Cloud’s Secure Score, you notice a recommendation indicating that several Azure virtual machines lack endpoint protection. You open the Inventory blade and see these non-compliant VMs listed. Which actions can you take to remediate this issue and improve your Secure Score? (Choose two)
- A
Use the 'Remediate' option in the recommendation details to deploy endpoint protection to the identified VMs
- B
Enable a policy exemption for the recommendation to remove the affected VMs from the Secure Score calculation
- C
Configure the auto-provisioning of a specific endpoint protection extension through Microsoft Defender for Cloud settings
- D
Delete the non-compliant VMs from the subscription to remove them from the Secure Score
Show answer and explanation
Correct answers: A, C
Explanation
Microsoft Defender for Cloud’s Secure Score is improved by implementing actual remediations that address identified security gaps, such as installing endpoint protection. Using the built-in remediation flow or configuring auto-provisioning through the Azure portal ensures the recommendation is addressed correctly. For more details, see the official Microsoft Defender for Cloud documentation on installing and configuring endpoint protection: https://learn.microsoft.com/azure/defender-for-cloud/.
- A. Correct.
Option 1 is correct. Microsoft Defender for Cloud provides a built-in way to remediate many recommendations directly from the portal. By selecting 'Remediate' under the specific recommendation, you can deploy an endpoint protection solution to the non-compliant VMs.
- B. Incorrect.
Option 2 is incorrect. While you can create policy exemptions, doing so will not actually secure the VMs, nor is it considered a best practice to ignore a security recommendation just for improving the score. It also defeats the purpose of remediating real risks.
- C. Correct.
Option 3 is correct. Auto-provisioning in Microsoft Defender for Cloud can automatically install endpoint protection extensions on Azure VMs. Enabling this feature aligns with best practices by ensuring new or existing VMs have the required protection.
- D. Incorrect.
Option 4 is incorrect. Deleting all non-compliant VMs is not a secure or practical remediation strategy. Removing a resource outright only masks the security issue instead of addressing it, and might disrupt business operations.