Module 5: Defender for Cloud

What is Microsoft Defender for Cloud

Cloud Native Application Protection Platform (CNAPP)

What are the two primary pillars of Microsoft Defender for Cloud

Cloud Security Posture Management and Cloud Workload Protection

What is Cloud Security Posture Management (CSPM)

Identifies and remediates cloud misconfigurations

What is Cloud Workload Protection (CWPP)

Protects workloads from active threats

What is Microsoft Defender CSPM

Provides posture management across cloud environments

What is Defender for Servers

Protects Azure and hybrid servers

What is Defender for Storage

Protects storage accounts from threats

What is Defender for SQL

Protects SQL databases from attacks

What is Defender for Key Vault

Protects Azure Key Vault resources

What is Defender for Containers

Protects Kubernetes and container workloads

What is Defender for Resource Manager

Detects suspicious Azure control-plane activities

What is Defender for DNS

Detects suspicious DNS activity

What is Defender for App Service

Protects Azure App Service applications

What is Secure Score

Measures cloud security posture

What is a Secure Score recommendation

Action that improves Secure Score

What is Secure Score impact

Points gained from completing recommendations

What is a Security Recommendation

Guidance to reduce security risk

What is Regulatory Compliance Dashboard

Tracks compliance against standards and frameworks

What is Azure Policy

Service used to assess and enforce compliance

What is Regulatory Compliance Standard

Framework such as NIST or ISO 27001

What is an Assessment in Regulatory Compliance

Evaluation of a compliance requirement

What is a Compliance Control

Requirement within a compliance framework

What is a Healthy Resource

Resource meeting security requirements

What is an Unhealthy Resource

Resource failing security requirements

What is Attack Path Analysis

Identifies exploitable attack paths

What is Cloud Security Explorer

Visual tool for analyzing cloud risks

What is a Security Alert

Notification of suspicious activity

What is a Security Incident

Collection of related alerts

What is Alert Correlation

Grouping alerts into incidents

What is Microsoft Sentinel integration

Sends alerts and incidents to Sentinel

What are Environment Settings

Configuration settings for Defender plans

What is a Defender Plan

Protection package for a resource type

What is Agentless Scanning

Scans resources without installing agents

What is Malware Scanning

Scans workloads for malicious files

What is Vulnerability Assessment

Evaluates systems for security weaknesses

What is Defender for Containers Vulnerability Assessment

Scans container images for vulnerabilities

What is Defender for Servers Plan 1

Basic server protection

What is Defender for Servers Plan 2

Advanced protection with additional security features

What is Just-In-Time (JIT) VM Access

Temporarily opens management ports when needed

What is Adaptive Application Controls

Creates allowlists for approved applications

What is File Integrity Monitoring

Detects changes to important files

What is a Security Policy

Collection of security requirements

What is Multi-Cloud Support

Protection for Azure, AWS, and GCP resources

What is AWS Connector

Connects AWS resources to Defender for Cloud

What is GCP Connector

Connects Google Cloud resources to Defender for Cloud

What is the Inventory Page

Displays protected resources

What is Resource Health

Security status of a resource

What is a Cloud Workload

Application or service running in the cloud

What is Azure Resource Graph

Query service for Azure resources

What is Exposure Score

Measures exposure to attack paths

What is Risk Prioritization

Ranks risks by severity and exposure

What is Adaptive Network Hardening

Recommends network security rule improvements

What is Internet Exposure

Resource accessible from the internet

What is Lateral Movement Risk

Potential attacker movement between resources

What is Defender for APIs

Protects published APIs from threats

What is API Security Posture

Assessment of API security configuration

What is a Cloud Attack Path

Route attackers may use to reach assets

What is Security Posture

Overall security condition of cloud resources

What is a Hybrid Environment

Combination of cloud and on-premises resources

What is a Remediation Task

Action performed to resolve a recommendation

What is a Recommendation Exemption

Excludes a recommendation from evaluation

What is Continuous Security Assessment

Ongoing evaluation of resources

What is a Cloud Misconfiguration

Incorrect cloud setting that increases risk

What is the main goal of Defender for Cloud

Reduce cloud risk and improve security posture

What is the main difference between CSPM and CWPP

CSPM finds misconfigurations; CWPP protects workloads from threats

Which Defender for Cloud feature is used most for exam questions involving exposed RDP ports

Just-In-Time VM Access

Which service powers compliance assessments in Defender for Cloud

Azure Policy

Which feature recommends NSG rule improvements

Adaptive Network Hardening

What is the purpose of Secure Score

Measure and improve cloud security posture

What is the purpose of Vulnerability Assessment

Identify security weaknesses

What is the purpose of Workflow Automation

Automate security responses

What is the purpose of Exposure Score

Prioritize risks based on exposure

What is the purpose of Recommendation Exemptions

Exclude accepted risks from assessment