A security engineer is reviewing the security recommendations in Microsoft Defender for Cloud and finds a recommendation stating, 'Virtual machines should be migrated to a supported operating system version'. The engineer determines that several legacy applications running on these VMs cannot be updated and require the older OS versions. To avoid this recommendation negatively impacting the secure score without addressing the underlying OS, what action should the engineer take within Defender for Cloud?
- AMark the recommendation as 'Resolved' manually.
- BModify the secure score calculation to ignore this recommendation.
- CCreate an exclusion for the specific VMs from this recommendation.
- DDisable the recommendation entirely for the entire subscription.
Show answer & explanationAnswer & explanation
Correct answer: C. Create an exclusion for the specific VMs from this recommendation.
Creating an exclusion for specific resources from a recommendation allows the secure score to accurately reflect the security posture of compliant resources while acknowledging known exceptions. This is preferable to disabling the recommendation entirely, which would hide it for all resources, or manually marking it as resolved without actual remediation.
Why the other options are wrong
- A. Manually marking as 'Resolved' implies the issue was fixed, which is not the case here, and the recommendation would likely reappear.
- B. There is no direct option to modify the secure score calculation to ignore a specific recommendation without addressing or excluding it.
- D. Disabling the recommendation for the entire subscription would hide the issue for other VMs that *could* be migrated, which is not ideal.
Defender for Cloud Recommendation Exclusions
A feature in Microsoft Defender for Cloud that allows specific resources or entire subscriptions to be exempted from certain security recommendations, typically for valid business reasons, without negatively impacting the secure score for non-exempted resources.
- Helps manage secure score accurately.
- Can be applied to subscriptions, resource groups, or individual resources.
- Requires justification and can be time-limited.
Memory trick: Recommendations guide, but exclusions handle unique needs.