Microsoft Security Operations AnalystMitigate threats using Microsoft Defender for CloudEasy
A security analyst is monitoring the security posture of an Azure subscription using Microsoft Defender for Cloud. They observe a critical recommendation stating, 'SQL databases should have auditing enabled.' The recommendation provides a 'Quick fix' option. What is the most likely underlying technology that enables this 'Quick fix' to automatically remediate the auditing setting for Azure SQL Databases?
- AAzure Policy with 'deployIfNotExists' effect
- BAzure Resource Health
- CAzure Monitor Log Analytics
- DAzure Security Center Playbooks
Show answer & explanationAnswer & explanation
Correct answer: A. Azure Policy with 'deployIfNotExists' effect
Many 'Quick fix' options in Microsoft Defender for Cloud are powered by Azure Policy, specifically using the 'deployIfNotExists' effect, which automatically applies the recommended configuration (like enabling auditing) if it's found to be missing or misconfigured.
Why the other options are wrong
- B. Azure Resource Health provides information about the health of Azure resources, not for automated security remediation.
- C. Azure Monitor Log Analytics is used for collecting and analyzing logs, not for automatically remediating security configurations.
- D. Azure Security Center Playbooks (now Workflow automation) can be used for more complex, event-driven responses, but simpler configuration remediations are typically handled by Azure Policy.
Quick Fix (Azure Policy)
Automated remediation actions in Microsoft Defender for Cloud, often leveraging Azure Policy's 'deployIfNotExists' effect, to bring non-compliant resources into compliance with security recommendations.
- Streamlines remediation of common security findings.
- Relies on Azure Policy definitions and assignments.
- Applies configurations or deploys resources automatically.
- Reduces manual effort for security posture management.
Memory trick: A quick fix for a setting, Policy's deployIfNotExists is the betting.