Microsoft Security Operations AnalystMitigate threats using Microsoft Defender for CloudMedium
A security engineer is implementing a security baseline for Azure Kubernetes Service (AKS) clusters using Microsoft Defender for Cloud. The organization requires continuous monitoring for misconfigurations, deviations from best practices, and runtime threats within the Kubernetes environment, including pods, containers, and nodes. Which Defender for Cloud plan should be enabled to provide this comprehensive protection for AKS clusters?
- AMicrosoft Defender for App Service
- BMicrosoft Defender for Containers
- CMicrosoft Defender for Servers
- DMicrosoft Defender for Key Vault
Show answer & explanationAnswer & explanation
Correct answer: B. Microsoft Defender for Containers
Microsoft Defender for Containers provides comprehensive threat protection for containerized environments, including AKS clusters, by continuously monitoring for vulnerabilities in container images, misconfigurations in Kubernetes, and runtime threats on nodes and within pods.
Why the other options are wrong
- A. Defender for App Service protects Azure App Service resources, not Kubernetes clusters.
- C. Defender for Servers protects virtual machines and physical servers; while AKS nodes are VMs, Defender for Containers offers specialized, deeper protection for the Kubernetes layer itself.
- D. Defender for Key Vault protects Azure Key Vaults, not Kubernetes clusters.
Microsoft Defender for Containers
Microsoft Defender for Containers provides comprehensive security for containerized environments, including Azure Kubernetes Service (AKS) clusters, by offering vulnerability management, runtime threat protection, and hardening recommendations.
- Scans container images for vulnerabilities.
- Monitors AKS clusters for misconfigurations and deviations from best practices.
- Detects runtime threats on Kubernetes nodes and within pods.
- Integrates with Azure Policy for Kubernetes to enforce security policies.
Memory trick: Container's care: Code, config, and runtime, all protected.