Microsoft Security Operations AnalystMitigate threats using Microsoft Defender for CloudMedium
A security analyst is reviewing the 'Recommendations' blade in Microsoft Defender for Cloud for a new Azure subscription. They notice a recommendation to 'Enable System Updates' for several virtual machines. Upon further investigation, they find that these VMs are running an older operating system version that is no longer supported by Microsoft for automatic updates. What action should the analyst recommend to address this security finding effectively?
- AUpgrade the operating system to a supported version or decommission the VMs.
- BManually install the latest updates on the unsupported OS versions.
- CConfigure Azure Update Management to scan for missing updates.
- DSuppress the recommendation as it cannot be remediated.
Show answer & explanationAnswer & explanation
Correct answer: A. Upgrade the operating system to a supported version or decommission the VMs.
If an operating system is unsupported, it will no longer receive security updates, making it a significant vulnerability. The most effective long-term solution is to upgrade to a supported OS or decommission the vulnerable VMs.
Why the other options are wrong
- B. Manually installing updates on an unsupported OS is not feasible as updates are no longer released by the vendor.
- C. Azure Update Management relies on vendor-provided updates; it cannot provide updates for an unsupported operating system.
- D. Suppressing the recommendation would ignore a critical vulnerability and not improve security posture.
Unsupported Operating Systems
Operating system versions that have reached their end-of-life (EOL) and no longer receive security updates, bug fixes, or technical support from the vendor, posing significant security risks.
- Vulnerable to unpatched exploits.
- No new security patches are released.
- May not be compliant with regulatory standards.
- Requires migration or decommissioning for effective risk management.
Memory trick: An old OS, no longer supported, must be upgraded or discarded, for new security to be afforded.