Exam SC-100 topic 3 question 2 discussion

I would select A and B

I like A and B for this one - enable the defender for containers plan - then ensure it deploys to your container resources with auto provision.

I would select A and D. Enable Defender plans: By enabling Defender plans in Microsoft Defender for Cloud, you can provide security assessments and recommendations for all resources, including AKS resources. Assign regulatory compliance policies: By assigning regulatory compliance policies, AKS resources will be evaluated according to security standards and reflected in the Secure Score. B is for setting up automatic provisioning of resources and is not directly involved in updating the Secure Score. E also is not directly involved in updating the Secure Score.

Enable Defender Plans: Enable Defender plans for your AKS resources. Defender plans provide security recommendations and insights specific to the services you use. By enabling Defender plans, you ensure that AKS is included in the secure score calculations. Points: 1 Review the Inventory: Ensure that all AKS resources are correctly identified and included in your inventory. Review the list of resources to verify their inclusion. Any missing resources should be added to the inventory. Points: 1

To produce accurate recommendations and update the secure score for AKS resources in Microsoft Defender for Cloud, you should: A. Enable Defender plans: This will ensure that the AKS resources are being monitored by Microsoft Defender for Cloud, which will include them in the secure score recommendations. D. Assign regulatory compliance policies: This will apply the necessary compliance controls against the AKS resources, which can help in identifying security configurations that are not in compliance with the required standards, thus affecting the secure score.

I would go with A&B

By enabling Defender plans and reviewing the inventory, you can ensure that the AKS resources are properly evaluated, and their security posture is reflected in the secure score.

Although by default Enabling the Defender plan also configures auto-provisioning, to align with CAF you would then configure auto-provisioning to use a centralised rather than the default log analytics workspace. So its A&B

AB is the answer. https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-containers-enable

AE CORRECT

For me it's A & D, it's simple, first you should active the Defender Plan, and microsoft say that auto provisioned id activated by default, so, we cannot shoose it because it's given by microsoft, and for the secure score, we should have policy defenition assigned, else we will not increase secure score

Since AKS was observed as excluded, it needs to be re-enabled and auto provisioned.

Para producir recomendaciones precisas y actualizar la puntuación segura en Microsoft Defender para la nube en relación con los recursos de AKS, se recomienda: A. Habilitar los planes de Defender para la suscripción de Azure que contiene los recursos de AKS. Esto permitirá que Microsoft Defender para la nube recolecte datos de seguridad de los recursos y proporcionará recomendaciones específicas de seguridad. E. Revisar el inventario de recursos de AKS en cada suscripción de Azure y asegurarse de que se están siguiendo las mejores prácticas de seguridad. Esto ayudará a identificar cualquier problema de seguridad que pueda existir y tomar medidas para abordarlos.

The correct answer is A and E. No one can counter this statement. prove me wrong

The two actions that should be recommended in Microsoft Defender for Cloud to produce accurate recommendations and update the secure score are: A. Enable Defender plans: Enabling Defender plans for Azure Kubernetes Service will enable the Defender for Kubernetes solution to collect and analyze security events and provide recommendations for improving the security posture of the AKS resources. Defender for Kubernetes integrates with Azure Security Center and Azure Monitor to provide a unified view of security posture and insights. E. Review the inventory: Reviewing the inventory in Microsoft Defender for Cloud will enable you to identify all the AKS resources and Docker images deployed across the four Azure subscriptions. This will help you assess the security posture of the resources, identify potential vulnerabilities and misconfigurations, and prioritize remediation actions.

Tricky…I can understand B,D. “ When you enable Microsoft Defender for Containers, Azure Kubernetes Service clusters, and Azure Arc enabled Kubernetes clusters (Preview) protection are both enabled by default.”

A and B for sure! I have tested it in the lab trust me