AZ-500 Question 234
Single answerYour organization has recently onboarded Microsoft Defender External Attack Surface Management (EASM) to discover and monitor all internet-facing assets. In the first scan, EASM identifies an abandoned marketing website under your company's domain, with an expired certificate still publicly accessible. According to best practices, what is the most appropriate step to take next to mitigate this external exposure?
- A
Add the discovered website to a blocklist within EASM, preventing any further external access automatically.
- B
Allow EASM to remove the DNS record from the public domain registry, thus shutting the site down immediately.
- C
Mark the asset as 'Verified' within the EASM asset inventory and engage the appropriate team to decommission or remediate the site.
- D
Replace the expired certificate on the abandoned site to regain compliance and stop EASM from flagging the asset.
Show answer and explanation
Correct answer: C
Explanation
Microsoft Defender EASM identifies external internet-facing assets and brings them into a single visibility dashboard. When an asset is no longer needed or poses a security risk (e.g., expired certificate, abandoned content), the recommended approach is to mark and verify the asset, then coordinate with relevant stakeholders to decommission or remediate it. EASM does not block external traffic or modify DNS records directly; it provides continuous discovery and monitoring so you can take corrective action. For more information, refer to the official Microsoft documentation on Microsoft Defender External Attack Surface Management.
- A. Incorrect.
Incorrect: EASM does not function as a firewall or content filter to block traffic. Adding an asset to a 'blocklist' in EASM does not prevent internet access to that site.
- B. Incorrect.
Incorrect: EASM cannot remove an external DNS record on your behalf. You must coordinate with your domain registrar or DNS administrator to remove or update DNS records.
- C. Correct.
Correct: Marking the asset as 'Verified' in EASM ensures proper tracking in your asset inventory, and then you can coordinate with the relevant teams (e.g., IT or domain owners) to retire or secure the site, resolving the exposure.
- D. Incorrect.
Incorrect: Simply replacing the certificate renews the site’s validity but does not address why the abandoned site remains exposed. Best practice is to properly decommission if the site is no longer required.