Knowledge check

1.

A security team wants to discover plaintext connection strings stored on Azure virtual machine (VM) disks across their subscription. Which Microsoft Defender for Cloud plan provides this agentless scanning capability?

Microsoft Defender for Key Vault

Foundational CSPM

Defender Cloud Security Posture Management (CSPM) or Defender for Servers Plan 2

Microsoft Defender for Servers Plan 1

2.

Microsoft Defender for Key Vault generates an alert for access from The Onion Router (TOR) exit node. What is the correct first step in the investigation and response process?

Immediately revoke all access policies and RBAC assignments on the Key Vault.

Dismiss the alert because the source IP belongs to the Microsoft address space.

Rotate all secrets in the Key Vault before investigating the alert details.

Verify whether the traffic originated from within your Azure tenant to identify the source.

3.

A security engineer reviews Defender CSPM findings and sees that an ARM template contains a plaintext storage account connection string. How should they remediate this finding?

Enable the Defender CSPM plan to suppress the finding.

Remove the hardcoded secret from the deployment template and store it as a secret in Azure Key Vault, referenced at runtime.

Enable purge protection on the Key Vault to prevent the secret from being deleted.

Configure a Key Vault firewall rule to block access from the deployment service.

4.

An organization enabled Microsoft Defender for Key Vault but hasn't enabled Defender CSPM. Which security risk remains unaddressed?

Anomalous access patterns targeting the Key Vault won't generate alerts.

The Key Vault won't enforce role-based access control for secrets.

Plaintext credentials stored on VM disks or in deployment templates won't be detected.

Defender for Key Vault alerts won't appear in the Security alerts page in Defender for Cloud.

Check your knowledge

Feedback