Knowledge check

1.

A security engineer wants visibility into internet-facing assets their organization doesn't know about—including forgotten test environments from an acquisition and developer-created shadow IT. Which Microsoft Defender tool provides this outside-in discovery capability?

Microsoft Defender for Cloud Security Posture Management (CSPM)

Microsoft Defender Vulnerability Management (MDVM)

Microsoft Defender External Attack Surface Management (EASM)

Microsoft Defender for Endpoint

2.

You're configuring EASM discovery for your organization after an acquisition. You provide the acquired company's primary domain name as a starting point. What is this starting asset called in the EASM discovery process?

A discovery target

A discovery seed

A candidate asset

An inventory filter

3.

After running EASM discovery for a recently acquired company's infrastructure, your security team finds several hosts with Telnet (port 23) open and multiple SSL certificates expiring within 30 days. Which EASM dashboard surfaces these specific technical findings?

Overview dashboard

Attack surface summary dashboard

Security posture dashboard

OWASP Top 10 dashboard

4.

Your organization has Defender CSPM active. You want to find attack paths that start from internet-exposed IP addresses discovered by EASM and trace through to internal Azure resources. Where do you view these attack paths?

In the EASM standalone portal at the Security posture dashboard

In the Microsoft Defender portal under Cloud security, go to Attack path analysis

In Microsoft Sentinel under the Threat Intelligence workbook

In the Azure portal under Microsoft Defender for Cloud, go to Workload protections

Check your knowledge

Feedback