SC-500: Implementing End-to-End Security Controls for Cloud and AI Workloads

By Microsoft · Question Mode

QuestionQ24

Manage and monitor security posture

HOTSPOT -

You have an Azure subscription named Sub1 that contains 50 virtual machines. Microsoft Defender for Cloud is enabled for Sub1.

Sub1 contains an Azure key vault named KV1 and an Azure policy requiring all secrets to be stored in KV1.

Occasionally, company developers store plaintext tokens and SSH private keys on the virtual machines.

You must configure Defender for Cloud to detect plaintext secrets on the virtual machines while minimizing administrative changes to those virtual machines.

How should you configure Defender for Cloud?

Select
Plan to enable:
Feature to enable:
Explanation

Defender CSPM supports agentless machine scanning, including machine secrets scanning. It scans VM disk snapshots to find exposed plaintext secrets and can validate SSH private keys, without deploying an agent or requiring network connectivity to the VM.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!