Defender for Cloud & Sentinel
CSPM · Workload protection · Regulatory compliance · SIEM
Practice questions for this topic →
Pick the tool
| Need | Service |
|---|---|
| Posture: secure score, recommendations (free) | Defender for Cloud Foundational CSPM (Microsoft Cloud Security Benchmark) |
| Attack path analysis, risk prioritization | Defender CSPM (paid) |
| Threat protection for VMs, SQL, Storage, containers, Key Vault | Defender for Cloud workload plans |
| Compliance against PCI DSS, ISO 27001, NIST… | Regulatory compliance dashboard (assign standards) |
| SIEM + SOAR across Azure, M365, on-prem, other clouds | Microsoft Sentinel (Defender portal) |
Facts to know
- Regulatory compliance dashboard: a control that can't be assessed automatically appears greyed out; a standard with no relevant resources isn't shown at all, even if assigned.
- Sentinel: after March 31, 2027 it's supported only in the Microsoft Defender portal (already GA there, including without Defender XDR or E5).
- Sentinel playbooks are Logic Apps workflows; automation rules run them automatically, for example to isolate a machine and block an account.
Exam Tips
Tick each tip once you can answer it without looking.
“Free continuous assessment and secure score across subscriptions” → Defender for Cloud Foundational CSPM.
“Identify exploitable attack paths to sensitive data” → Defender CSPM (paid).
“Show compliance status against PCI DSS for auditors” → Defender for Cloud regulatory compliance dashboard. Trap: Azure Policy alone has no standards-mapped dashboard.
“Detect threats on VMs, just-in-time VM access, file integrity monitoring” → Defender for Servers.
“Detect malware uploaded to blob storage” → Defender for Storage (malware scanning).
“Correlate security events from many sources and automate response playbooks” → Microsoft Sentinel (SIEM + SOAR with Logic Apps playbooks).
“Assess AWS and GCP posture from the same pane” → Defender for Cloud multicloud connectors.
“Security alerts must create an incident automatically” → Sentinel analytics rules + automation rules / playbooks.
“A control is greyed out in the regulatory compliance dashboard” → It can't be assessed automatically, so compliance can't be decided. Trap: A standard with no relevant resources isn't shown at all.
“Sentinel after March 31, 2027” → Supported only in the Microsoft Defender portal (already GA there). Trap: It can be used without Defender XDR or E5.