Manage and monitor security posture practice questions

Cloud security explorer runs graph-based queries on the cloud security graph to hunt for risks by combining asset, exposure, vulnerability and permission conditions across clouds.

The analyst needs an ad hoc, multicloud search with two conditions, a shareable link and a CSV export. Those are exactly the features of cloud security explorer. Attack paths are precomputed scenarios, workflow automation reacts to changes, and governance rules drive remediation ownership.

1. Identify the need: a custom search that combines exposure and vulnerability.
2. It must cover Azure and AWS.
3. It must be shareable and exportable.
4. Cloud security explorer offers query templates, Share query link and Download CSV report.

Exam tip: Hunting with your own conditions across clouds is cloud security explorer; precomputed risk chains are attack paths.

Governance rules (a Defender CSPM feature) automatically give recommendations an owner and a due date, read owners from a resource tag or a fixed email address, and send weekly reminder emails.

The requirement has three parts: automatic owner assignment from a tag, a remediation deadline, and weekly reminders. A governance rule scoped by severity, with owner set By resource tag and a 30-day time frame, covers all three with no custom code. A Logic App would need building and still wouldn't track due dates, and policy or alert notifications don't assign recommendations.

1. List the requirements: owner from a tag, due date, reminders.
2. Governance rules assign owners by resource tag or email.
3. They set a 7, 14, 30 or 90-day time frame.
4. Weekly owner emails are on by default, so no custom automation is needed.

Exam tip: Owners and deadlines for recommendations come from governance rules; owners can be read from a resource tag.

A governance rule's grace period keeps covered MCSB recommendations out of the secure score until they are overdue, and existing recommendations are only assigned when you apply (or rerun) the rule for them.

Two separate settings are needed. The grace period answers the secure-score requirement. Applying the rule to existing recommendations that have no owner or due date answers the backlog requirement; otherwise the rule only acts as new recommendations match it. Priority and scope settle conflicts between rules, and a longer time frame only moves the due date.

1. Split the requirements: backlog assignment and score protection.
2. Score protection is the rule's grace period.
3. Backlog assignment is applying the rule to existing recommendations.
4. Priority, scope and the length of the time frame don't meet either requirement.

Exam tip: Grace period protects the secure score; applying or rerunning the rule covers recommendations that existed before it.

The classic secure score counts only generally available, built-in Microsoft cloud security benchmark recommendations. Preview recommendations are listed but don't affect the score.

The deciding clue is the Preview label. Defender for Cloud excludes preview recommendations from the secure score so new checks don't swing scores while they mature. The score recalculates every eight hours, and it depends neither on Defender plans nor on owner assignment.

1. Note the recommendation's maturity: Preview.
2. Recall that preview recommendations are excluded from the score.
3. Rule out timing: controls recalculate every eight hours.
4. Fix the findings anyway so they count once the recommendation is GA.

Exam tip: Preview recommendations never move the secure score; only GA built-in MCSB recommendations do.

Classic secure score: each control has a max score; current score = (max score / healthy + unhealthy resources) x healthy resources, and a resource is healthy for a control only when it passes every recommendation in that control.

Remediating some recommendations in a control doesn't earn partial points. Every VM still fails one recommendation in Secure management ports, so all 20 remain unhealthy for that control and its current score stays at zero. Resolving the last recommendation would make them healthy and award the control's points.

1. Find the control and the number of resources it covers.
2. Check whether each resource passes every recommendation in the control.
3. One open recommendation keeps each VM unhealthy for the control.
4. Remediate the remaining recommendation to earn the points.

Exam tip: Secure score rewards whole controls per resource: partial fixes inside a control earn nothing.

The Regulatory compliance dashboard has two evidence options: Download report (your own compliance status for a standard, as PDF or CSV) and Audit reports (Microsoft's certifications of its cloud services).

The auditor wants your subscription's status for PCI DSS, organized by controls, as a PDF. Download report produces exactly that from Defender for Cloud's assessment data. Audit reports would show Microsoft's certification of Azure, which addresses a different question.

1. Identify whose compliance is in question: your resources.
2. Identify the format: a PDF summary by control.
3. Download report gives your status for the selected standard.
4. Audit reports are for Microsoft's own certifications.

Exam tip: Your status is Download report; Microsoft's certificates are Audit reports.