AZ-500 Question 233
Single answerYour organization has deployed Microsoft Defender External Attack Surface Management (EASM) to monitor and discover unknown external-facing assets. You want to ensure any new subdomains under your primary domain are automatically detected so you can maintain an up-to-date inventory. Which of the following actions is crucial for allowing EASM to identify new subdomains as soon as they appear?
- A
Configure an explicit TXT record for each new subdomain at the domain registrar.
- B
Create a custom Azure Resource Graph query to track DNS records across all subscriptions.
- C
Add the top-level domain (root domain) to Microsoft Defender EASM as a seed domain for continuous discovery.
- D
Enable DNS zone transfer from your internal DNS servers to Microsoft Defender EASM.
Show answer and explanation
Correct answer: C
Explanation
To effectively discover new subdomains, Microsoft Defender EASM requires that you configure a root or top-level domain (also referred to as a seed domain) within its discovery settings. EASM then continuously scans open-source data, DNS records, and internet-facing endpoints to detect subdomains. According to Microsoft documentation, adding a top-level domain provides EASM with the necessary information to monitor any domain extensions as soon as they appear, ensuring a complete external surface inventory.
- A. Incorrect.
Incorrect. While domain verification with a TXT record is sometimes required to prove domain ownership, you do not need a separate TXT record for each subdomain. EASM can automatically discover new subdomains from a properly added root domain.
- B. Incorrect.
Incorrect. Azure Resource Graph queries are useful for exploring resources within Azure subscriptions, but they do not automatically detect external public DNS records or subdomains across the internet. EASM relies on internet-facing asset discovery rather than only Azure configurations.
- C. Correct.
Correct. By adding the organization’s root domain to EASM as a seed, the system automatically scans for newly created or existing subdomains across public DNS records. This continuous discovery process aligns with how EASM is designed to operate for external asset management.
- D. Incorrect.
Incorrect. DNS zone transfers typically provide deeper DNS information but are not the primary mechanism EASM uses for automated external subdomain discovery. EASM gathers intelligence from multiple external data sources rather than relying solely on zone transfers from internal DNS.