An organization is using Azure Security Center (now Microsoft Defender for Cloud) to manage its security posture. They have observed that certain virtual machines consistently report high-severity security recommendations, but these recommendations are already addressed by external security tools or organizational policies not recognized by Defender for Cloud. To avoid skewing their security score and focus on relevant recommendations, which action should they take?
- AManually remediate the recommendations within Defender for Cloud.
- BExclude specific resources or recommendations from the security policy.
- CCreate a custom security policy that omits these recommendations.
- DDisable the entire security policy for those recommendations.
Show answer & explanationAnswer & explanation
Correct answer: B. Exclude specific resources or recommendations from the security policy.
Microsoft Defender for Cloud allows you to exclude specific resources or recommendations from a security policy. This is useful when a recommendation is addressed by a third-party tool, a compensating control, or is not applicable to a specific resource, preventing it from impacting your secure score unnecessarily.
Why the other options are wrong
- A. Manual remediation is not applicable if the recommendation is already addressed by an external tool or policy.
- C. Creating a custom policy that omits recommendations is less efficient than excluding specific items from an existing policy, especially if only a few resources or recommendations are exceptions.
- D. Disabling the entire policy is too broad and might hide other important recommendations.
Defender for Cloud Exclusions
Microsoft Defender for Cloud allows users to exclude specific resources or security recommendations from their security policies. This feature is crucial for maintaining an accurate secure score when recommendations are addressed by external means, are not applicable, or have compensating controls in place.
- Prevents specific recommendations from impacting secure score.
- Can exclude resources, recommendations, or both.
- Useful for compensating controls or third-party solutions.
- Helps focus on actionable and relevant recommendations.
Memory trick: Exclude the noise to focus on the score.