AZ-500 Question 225
Select 2Your organization must comply with a new, industry-specific standard that is not included among Microsoft Defender for Cloud’s built-in compliance frameworks. You want to track your environment’s adherence to this new standard within Microsoft Defender for Cloud. Which two actions should you take first to integrate this new compliance standard?
- A
Create a custom initiative in Azure Policy that maps to the new standard’s requirements.
- B
Enable Microsoft Defender for DevOps to automatically register your custom standard in Microsoft Defender for Cloud.
- C
Assign the custom initiative to the relevant subscriptions or management groups through the Regulatory compliance blade.
- D
Modify the built-in CIS standard in Microsoft Defender for Cloud to include the new standard’s controls.
Show answer and explanation
Correct answers: A, C
Explanation
To manage a custom compliance standard in Microsoft Defender for Cloud, you first create a custom initiative in Azure Policy that reflects the controls or requirements of your new standard. Then, assign the initiative to your subscriptions or management groups. Microsoft Defender for Cloud aggregates the results in the Regulatory compliance blade and calculates your compliance posture. For more details, refer to the Microsoft Defender for Cloud documentation on creating and assigning custom policy initiatives: https://learn.microsoft.com/azure/defender-for-cloud/custom-security-standards.
- A. Correct.
Correct. Creating a custom initiative in Azure Policy is the recommended approach to represent new standards. You map relevant policies to the new standard's controls so Microsoft Defender for Cloud can assess compliance against those policies.
- B. Incorrect.
Incorrect. Microsoft Defender for DevOps does not handle creating or registering custom compliance standards. It focuses on securing software development pipelines, not on defining compliance frameworks in Microsoft Defender for Cloud.
- C. Correct.
Correct. Once you have created a custom initiative, you assign it to the desired subscriptions or management groups so it appears in the Regulatory compliance blade. This way, Microsoft Defender for Cloud can calculate compliance scores and recommendations.
- D. Incorrect.
Incorrect. You cannot modify built-in compliance standards such as CIS or PCI DSS directly. Instead, you must create and assign custom initiatives or use built-in ones as-is.