SC-100 Certification Practice Question #186

Question

You have a multicloud environment that contains an Azure subscription, an Amazon Web Services (AWS) subscription, and a Google Cloud Platform (GCP) subscription.

You plan to implement Cloud Security Posture Management (CSPM) by using Microsoft Defender for Cloud.

You need to design a solution that will provide attack path analysis functionality for each subscription.

What should you include in the solution?

Accepted Answer

Attack path analysis is a Defender CSPM capability built on the cloud security graph, and its documented prerequisite is enabling Defender CSPM and turning on agentless scanning (agentless machine scanning feeds the graph with software inventory, vulnerabilities, and exposure data across Azure, AWS, and GCP — exactly the multicloud subscriptions in the scenario). The MS Learn "Identify and remediate attack paths" page states the prerequisite verbatim: enable Defender CSPM and have agentless scanning enabled. Microsoft Cloud Security Benchmark and regulatory compliance are compliance/standards features, not enablers of attack path analysis, and Defender EASM is a separate external attack-surface discovery product. Suggested Answer, unanimous Most Voted (C, 7 votes), the two top comments, and MS Learn all converge on C.

More SC-100 practice questions