AZ-500 Question 226
Single answerYour organization has developed an internal compliance framework that includes unique controls not found in any of the built-in regulatory standards in Microsoft Defender for Cloud. You need these controls to appear and be tracked in the Defender for Cloud Regulatory compliance dashboard. Which of the following actions should you take to properly add a custom standard that includes your newly created controls?
- A
Use the 'Policies & Compliance' blade in Defender for Cloud to create a new compliance standard and add your custom controls directly within the blade.
- B
Create a custom initiative in Azure Policy with the required policies, assign it to the relevant scope, and then link this initiative as a new custom standard in the Defender for Cloud Regulatory compliance section.
- C
Export an existing built-in regulatory standard to a JSON file, insert your custom controls, and re-import the modified file as a new standard.
- D
Enable an existing built-in standard such as Azure Security Benchmark and override its controls with your custom definitions to effectively transform it into a custom standard.
Show answer and explanation
Correct answer: B
Explanation
To add a custom standard in Microsoft Defender for Cloud, you first create a custom initiative in Azure Policy that includes your organization’s custom policy definitions. After assigning this initiative to the appropriate subscription or management group, you can reference it under the 'Regulatory compliance' blade as a new custom standard. For more information, see Microsoft’s documentation on creating and managing custom standards in Defender for Cloud: https://learn.microsoft.com/azure/defender-for-cloud.
- A. Incorrect.
Incorrect. There is no direct option to create a new compliance standard and add custom controls entirely within Defender for Cloud’s 'Policies & Compliance' blade. You must first create a custom policy or initiative in Azure Policy and then associate it with the Defender for Cloud compliance view.
- B. Correct.
Correct. The recommended approach is to craft a custom initiative in Azure Policy with your specific control requirements, assign it to your desired scope (subscription or management group), and then link this initiative as a new custom standard under the Defender for Cloud Regulatory compliance blade.
- C. Incorrect.
Incorrect. While you can export policy definitions for review, there is no built-in method to simply export, edit, and import an entire regulatory standard as a new one. Defender for Cloud relies on Azure Policy initiatives to define and group controls.
- D. Incorrect.
Incorrect. Enabling a built-in standard does not allow you to replace or override its entire control set. Custom overrides in built-in standards are limited and cannot be used to create a fully custom standard with new controls.