Exam SC-100 topic 2 question 7 discussion

Actual exam question from Microsoft's SC-100

Question #: 7
Topic #: 2

HOTSPOT -
Your company has a multi-cloud environment that contains a Microsoft 365 subscription, an Azure subscription, and Amazon Web Services (AWS) implementation.
You need to recommend a security posture management solution for the following components:
✑ Azure IoT Edge devices

AWS EC2 instances -

Which services should you include in the recommendation? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:

Show Suggested Answer

Suggested Answer:

Box 1: Microsoft Defender for IoT
Microsoft Defender for IoT is a unified security solution for identifying IoT and OT devices, vulnerabilities, and threats and managing them through a central interface.
Azure IoT Edge provides powerful capabilities to manage and perform business workflows at the edge. The key part that IoT Edge plays in IoT environments make it particularly attractive for malicious actors.
Defender for IoT azureiotsecurity provides a comprehensive security solution for your IoT Edge devices. Defender for IoT module collects, aggregates and analyzes raw security data from your Operating System and container system into actionable security recommendations and alerts.
Box 2: Microsoft Defender for Cloud and Azure Arc
Microsoft Defender for Cloud provides the following features in the CSPM (Cloud Security Posture Management) category in the multi-cloud scenario for AWS.
Take into account that some of them require Defender plan to be enabled (such as Regulatory Compliance):
* Detection of security misconfigurations
* Single view showing Security Center recommendations and AWS Security Hub findings
* Incorporation of AWS resources into Security Center's secure score calculations
* Regulatory compliance assessments of AWS resources
Security Center uses Azure Arc to deploy the Log Analytics agent to AWS instances.
Incorrect:
AWS EC2 Microsoft Defender for Cloud Apps
Amazon Web Services is an IaaS provider that enables your organization to host and manage their entire workloads in the cloud. Along with the benefits of leveraging infrastructure in the cloud, your organization's most critical assets may be exposed to threats. Exposed assets include storage instances with potentially sensitive information, compute resources that operate some of your most critical applications, ports, and virtual private networks that enable access to your organization.
Connecting AWS to Defender for Cloud Apps helps you secure your assets and detect potential threats by monitoring administrative and sign-in activities, notifying on possible brute force attacks, malicious use of a privileged user account, unusual deletions of VMs, and publicly exposed storage buckets.
Reference:
https://docs.microsoft.com/en-us/azure/defender-for-iot/device-builders/security-edge-architecture https://samilamppu.com/2021/11/04/multi-cloud-security-posture-management-in-microsoft-defender-for-cloud/

by Alex_Burlachenko at Aug. 30, 2022, 6:46 p.m.

Comments

Submit Cancel

PlumpyTumbler

Highly Voted 2 years, 5 months ago

Good answer, bad references Defender for IoT https://docs.microsoft.com/en-us/azure/defender-for-iot/organizations/architecture EC2 instances need Defender for Cloud by way of Arc https://docs.microsoft.com/en-us/azure/defender-for-cloud/quickstart-onboard-aws?pivots=env-settings https://docs.microsoft.com/en-us/azure/azure-arc/servers/overview#supported-cloud-operations

upvoted 24 times

zts

2 years, 5 months ago

We should still be thankful with examtopic researchers for their efforts, and least such examples makes us to validate our review and correct those mistakes :D)

upvoted 20 times

AWSPro24

7 months ago

This is the way to study hands down. Trying to memorize the right answers just plain sucks. I actually end up learning more drilling these questions and digging in to figure out the right answer than I would just trying to memorize a ton of content.

upvoted 1 times

...

hb0011

2 years, 5 months ago

So this means the answer has to be Defender for IoT and Azure Arc only.

upvoted 2 times

...

Baz10

Highly Voted 10 months, 1 week ago

On Exam 8 Apr 2024 scored 764 answered as solution.

upvoted 7 times

...

ayadmawla

Most Recent 1 year, 1 month ago

AWS accounts should have Azure Arc auto provisioning enabled For full visibility of the security content from Microsoft Defender for servers, EC2 instances should be connected to Azure Arc. To ensure that all eligible EC2 instances automatically receive Azure Arc, enable auto-provisioning from Defender for Cloud at the AWS account level. https://learn.microsoft.com/en-us/azure/defender-for-cloud/recommendations-reference-aws

upvoted 1 times

...

Arockia

1 year, 1 month ago

For Question 1: Azure IoT Edge devices, the recommended security posture management solution is: e. Microsoft Defender for IoT: Microsoft Defender for IoT is designed specifically for securing IoT devices and provides advanced threat protection, vulnerability management, and continuous monitoring for IoT environments. It helps protect Azure IoT Edge devices by detecting and responding to security threats. For Question 2: AWS EC2 instances, the recommended security posture management solution is: f. Microsoft Defender for Endpoint only: Microsoft Defender for Endpoint (formerly known as Microsoft Defender ATP) is a comprehensive endpoint security solution that provides protection against various threats, including malware, advanced attacks, and vulnerabilities. While Azure Arc can be used to manage and monitor AWS resources, Microsoft Defender for Endpoint is the appropriate choice for securing the EC2 instances.

upvoted 2 times

AWSPro24

7 months ago

The question says security posture management. It's good to get into your head that Defender for Endpoint is basically AV / Anti-Malware. If you check it out you'll see it doesn't do "posture management" it does detect and respond. https://learn.microsoft.com/en-us/defender-endpoint/

upvoted 1 times

...

Ramye

1 year, 1 month ago

Any idea, why Microsoft XDR references don’t include Defender for IoT/OT. Below is what I see mostly The component services that are part of the Microsoft Defender XDR stack are: Microsoft Defender for Identity Microsoft Defender for Office 365 Microsoft Defender for Cloud Apps Microsoft Defender for Endpoint

upvoted 1 times

...