Manage security posture by using Defender for Cloud

Hollowell Pharma has an AWS Organization whose management account is 111111111111 and that contains 35 member accounts, with new accounts created every month. The security engineer must bring every current and future AWS account into Microsoft Defender for Cloud with Defender CSPM, and must avoid onboarding each new account manually.

What should you do when you create the AWS connector in Defender for Cloud?

1. AChoose Management account, then deploy the generated CloudFormation template as a StackSet from the management account so that it is applied to every member accountSelecting Management account makes Defender for Cloud create a connector for every member account automatically; the CloudFormation StackSet deploys the required roles into all current and future accounts in the organization.
2. BChoose Single account, enter 111111111111, and deploy the CloudFormation template as a Stack in the management accountA single-account connector onboards only the one account specified; member accounts would each need their own connector and template deployment.
3. CCreate one Single account connector per member account and deploy the CloudFormation Stack in each of the 35 accountsThis works for today's accounts but requires manual work for every new account, which the scenario forbids.
4. DInstall the Azure Connected Machine agent on an EC2 instance in each member accountAzure Arc onboarding is how Defender for Servers protects EC2 instances after the connector exists; it does not create the AWS connector or provide CSPM for the account.

Ashford Textiles has Defender for Servers Plan 2 enabled on a subscription named Sub-Mfg that contains 90 Azure VMs. About 70 VMs run the integrated Microsoft Defender for Endpoint sensor, and 20 VMs are locked-down appliances on which no additional software may be installed. The security engineer wants vulnerability findings for all 90 VMs to appear in Defender for Cloud recommendations and in the Defender portal, with no third-party scanner.

What should you configure in the Defender for Servers settings for Sub-Mfg?

1. ASet Vulnerability assessment for machines to Microsoft Defender Vulnerability Management and ensure Agentless scanning for machines is enabledDefender Vulnerability Management is the built-in scanner that works through the Defender for Endpoint sensor, and agentless scanning covers machines where no sensor can be installed; together they assess all 90 VMs.
2. BSet Vulnerability assessment for machines to the integrated Qualys scanner and deploy the Qualys extension to all VMsThe Qualys-based integrated scanner has been retired in Defender for Cloud and the appliance VMs cannot take an extension in any case.
3. CDeploy the Azure Monitor Agent to all 90 VMs with a data collection rule that collects the Update and Vulnerability logsAzure Monitor Agent collects telemetry for Log Analytics; it does not perform vulnerability assessment.
4. DEnable Defender CSPM on Sub-Mfg and disable the Defender for Servers plan to avoid duplicate scanningDefender CSPM provides agentless vulnerability scanning but disabling Defender for Servers removes the Defender for Endpoint integration and the host protection the company already relies on.

Pinecrest Analytics has a subscription named Sub-Data that contains 80 Azure virtual machines. Only Foundational CSPM is enabled. An internal audit found a plaintext storage account key in a script on one VM. The security engineer must find plaintext secrets such as connection strings and private keys on the disks of all 80 VMs and in the ARM and Bicep deployments in the subscription, and must also receive vulnerability findings for the VMs. The engineer is not allowed to install any agent or extension on the VMs.

Which two actions should you perform? Each correct answer presents part of the solution.

1. AEnable the Defender CSPM plan on Sub-DataDefender CSPM includes agentless scanning for machines, agentless secrets scanning on VM disks and in cloud deployments, and agentless vulnerability assessment powered by Microsoft Defender Vulnerability Management.
2. BIn the Defender CSPM plan settings, confirm that the Agentless scanning for machines extension is turned onAgentless machine scanning is the component that snapshots VM disks to find secrets and vulnerabilities; it is enabled by default with Defender CSPM but must be on for the scenario to work and is the only approach that installs nothing on the VM.
3. CEnable the Defender for Servers Plan 1 plan on Sub-DataPlan 1 relies on the integrated Microsoft Defender for Endpoint sensor, which is an agent, and it does not include agentless secrets scanning.
4. DDeploy the Azure Monitor Agent to all 80 VMs by using an Azure Policy initiativeThe scenario prohibits installing agents; Azure Monitor Agent collects logs and performance data and plays no role in secrets scanning.
5. EEnable Microsoft Defender for Key Vault on Sub-DataDefender for Key Vault detects suspicious access to vaults; it does not scan VM disks or deployment templates for exposed secrets.

Juniper Freight has a subscription named Sub-Core with Foundational CSPM only. After a red team exercise, the security engineer must be alerted when an attacker runs unusual resource management operations such as mass role assignments or suspicious use of an exploitation toolkit against the subscription, and when secrets are read from an Azure Key Vault named kv-juniper by an unusual user or from an unusual IP address. Cost must be kept to the plans that are strictly required.

Which two Defender for Cloud plans should you enable on Sub-Core? Each correct answer presents part of the solution.

1. ADefender for Resource ManagerDefender for Resource Manager monitors control-plane operations across the subscription and alerts on suspicious activity such as privilege escalation attempts and the use of exploitation toolkits.
2. BDefender for Key VaultDefender for Key Vault detects anomalous data-plane access to vaults, including access from unusual IP addresses, unusual users, and unusual access patterns.
3. CDefender for StorageDefender for Storage detects threats to storage accounts; it does not cover Key Vault access or Azure Resource Manager operations.
4. DDefender for Servers Plan 1Defender for Servers protects virtual machines through Defender for Endpoint; it does not monitor control-plane management operations or Key Vault access.
5. EDefender CSPMDefender CSPM finds posture weaknesses such as attack paths; it does not generate runtime threat alerts for Key Vault or Resource Manager activity.