AZ-500 Question 228
Single answerYou are a security engineer for a company that needs to include additional internal security controls that are not part of any pre-built compliance standard in Microsoft Defender for Cloud. You want these controls to be visible and enforced through the 'Regulatory compliance' dashboard. What is the correct way to add a custom standard to Microsoft Defender for Cloud?
- A
Create a new policy initiative in Azure Policy that includes your custom security controls, then add that initiative as a custom standard under the 'Regulatory compliance' settings in Microsoft Defender for Cloud.
- B
In Azure Active Directory, create a custom compliance policy and link it directly to Microsoft Defender for Cloud.
- C
Configure your additional security controls in the Diagnostics settings of each subscription and enable Microsoft Defender for Cloud to inherit them automatically.
- D
Add a custom rule to each Network Security Group (NSG) in the subscription to enforce your new security controls and display compliance results in Microsoft Defender for Cloud.
Show answer and explanation
Correct answer: A
Explanation
Adding a custom standard to Microsoft Defender for Cloud involves defining or reusing Azure Policy initiatives and referencing them in Defender for Cloud’s 'Regulatory compliance' blade. By creating or modifying an initiative that includes custom policies and then assigning it at the subscription or management group scope, you can visualize and track compliance against your internal controls. For more details, see Microsoft’s documentation on 'Add custom compliance standards in Microsoft Defender for Cloud' and 'Azure Policy initiatives.'
- A. Correct.
Correct. To add a custom standard, you must create (or modify) an initiative in Azure Policy that contains the relevant controls and definitions. Then, within Microsoft Defender for Cloud, navigate to 'Regulatory compliance' → 'Manage compliance policies' (or a similarly named section) to add your custom initiative as a standard. This ensures your internal controls appear in the compliance dashboard.
- B. Incorrect.
Incorrect. Azure Active Directory policies cannot be directly linked to Defender for Cloud as a custom regulatory standard. AAD policies typically handle identity and access management constraints, which is different from how Defender for Cloud manages compliance through Azure Policy initiatives.
- C. Incorrect.
Incorrect. The Diagnostics settings let you export or route Azure activity and resource logs, not define custom regulatory controls. You cannot create or track a custom standard through these settings.
- D. Incorrect.
Incorrect. Network Security Groups (NSGs) only manage inbound/outbound traffic rules. While NSGs are part of an overall security strategy, they are not a means to create or display compliance standards within Microsoft Defender for Cloud.