Microsoft cloud security benchmark and compliance
Compliance questions test whether you know which tool measures, which one enforces and which one covers Microsoft 365 rather than Azure.
Microsoft cloud security benchmark
The Microsoft cloud security benchmark (MCSB) is the successor of the Azure Security Benchmark. The exam may still use the old name. It has control domains such as network security, identity management, privileged access, data protection, logging and threat detection, posture and vulnerability management, and DevOps security. It maps to NIST, CIS and PCI-DSS.
It is the default standard in Defender for Cloud and covers Azure, AWS and GCP.
Defender for Cloud posture
Microsoft Defender for Cloud has two pillars:
| Pillar | What it does |
|---|---|
| Cloud Security Posture Management (CSPM) | Secure score, recommendations, regulatory compliance dashboard, attack path analysis (Defender CSPM plan) |
| Cloud Workload Protection (CWP) | Defender plans for servers, containers, storage, databases, App Service, Key Vault |
Foundational CSPM is free and gives the secure score and recommendations. Defender CSPM is the paid plan that adds attack path analysis, the cloud security graph and agentless scanning.
Measure, enforce, report
| Need | Use |
|---|---|
| Show compliance against NIST, ISO 27001, PCI | Regulatory compliance dashboard in Defender for Cloud |
| Add a standard such as NIST 800-53 | Assign a built-in initiative (Azure Policy) |
| Custom company standard | Custom security standard in Defender for Cloud (works across Azure, AWS and GCP) |
| Prevent noncompliant resources | Azure Policy with deny or deployIfNotExists |
| Deploy many controls together | Azure landing zones with policy initiatives |
| Microsoft 365 and data regulation | Microsoft Purview Compliance Manager |
Azure Blueprints was a way to package policy and RBAC. It is deprecated, so prefer template specs, deployment stacks and Azure Policy.
Governance structure
Apply policy at management group level so subscriptions inherit it. Follow the management group hierarchy from the Cloud Adoption Framework landing zone design. Use Azure Policy exemptions for exceptions instead of removing assignments.
Exam traps
- The dashboard in Defender for Cloud is for visibility. Azure Policy is for enforcement.
- For ISO or NIST, “first step” usually means assigning the initiative or adding the standard, not remediating.
- Compliance Manager (Purview) is for Microsoft 365 and data. Defender for Cloud is for cloud resources.
- Azure Security Benchmark and MCSB are the same lineage. Pick MCSB if both appear.
- Custom standards in Defender for Cloud can apply to Azure, AWS and GCP.
Practice questions
Choose an answer, then review the explanation to check your understanding.
1. You must review a subscription for NIST 800-53 compliance and see which controls fail. What do you do first?
Show answer
Answer: A.The regulatory compliance dashboard in Defender for Cloud shows results only after a standard (a built-in Azure Policy initiative) is assigned.
2. A company runs workloads in Azure, AWS and GCP. Which Defender for Cloud feature gives one security score and benchmark across all clouds?
Show answer
Answer: B.Connect AWS and GCP accounts as environments in Defender for Cloud. MCSB is assigned automatically and gives one posture view.
3. New resources must be forced to follow a standard and noncompliant ones must be detected automatically. Which service enforces and detects this?
Show answer
Answer: A.Azure Policy evaluates and, with deny or deployIfNotExists effects, enforces. The dashboard only reports.
4. A security team wants a score and improvement actions for Microsoft 365 and data compliance such as GDPR. Which tool?
Show answer
Answer: A.Compliance Manager in Microsoft Purview gives a compliance score and assessments for Microsoft 365 and regulations.