Microsoft Defender for Cloud in Azure - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to enable Microsoft Defender for Cloud on a subscription.

Azure

az security pricing create --name [1] --tier 'Standard' --subscription 'my-subscription-id'

Drag options to blanks, or click blank then click option'

AStorageAccounts

BVirtualMachines

CSqlServers

DAppServices

Attempts:

3 left

💡 Hint

Common Mistakes

Using a resource type that is not supported for pricing tier setting.

Forgetting to specify the subscription ID.

To enable Microsoft Defender for Cloud protection on virtual machines, use the 'VirtualMachines' pricing name.

2fill in blank

medium

Complete the code to list all security alerts in Microsoft Defender for Cloud.

Azure

az security alert list --subscription [1]

Drag options to blanks, or click blank then click option'

Amy-resource-group

Bmy-vm-name

Cmy-subscription-id

Dmy-storage-account

Attempts:

3 left

💡 Hint

Common Mistakes

Using a resource group name instead of subscription ID.

Using a resource name instead of subscription ID.

The command requires the subscription ID to list alerts for that subscription.

3fill in blank

hard

Fix the error in the command to disable Microsoft Defender for Cloud on Storage Accounts.

Azure

az security pricing create --name [1] --tier 'Free' --subscription 'sub-id-123'

Drag options to blanks, or click blank then click option'

AStorageAccounts

BVirtualMachines

CSqlServers

DAppServices

Attempts:

3 left

💡 Hint

Common Mistakes

Using the wrong resource type name.

Setting tier to 'Standard' instead of 'Free' to disable.

To disable Defender for Cloud on Storage Accounts, set the pricing tier to 'Free' for 'StorageAccounts'.

4fill in blank

hard

Fill both blanks to create a custom security policy assignment with Microsoft Defender for Cloud.

Azure

az policy assignment create --name 'DefenderPolicy' --policy [1] --scope [2]

Drag options to blanks, or click blank then click option'

A/providers/Microsoft.Authorization/policyDefinitions/DeployIfNotExistsSecurityCenter

B/subscriptions/12345678-1234-1234-1234-123456789abc

C/subscriptions/87654321-4321-4321-4321-cba987654321

D/providers/Microsoft.Security/defenderSettings

Attempts:

3 left

💡 Hint

Common Mistakes

Using a resource provider path instead of a policy definition ID.

Using a resource provider path instead of a subscription scope.

The policy definition ID for Defender is 'DeployIfNotExistsSecurityCenter'. The scope is the subscription ID where the policy applies.

5fill in blank

hard

Fill all three blanks to create a security automation that triggers on high severity alerts.

Azure

az security automation create --name 'HighSeverityAlertAutomation' --resource-group 'SecurityRG' --location 'eastus' --trigger [1] --condition [2] --action [3]

Drag options to blanks, or click blank then click option'

AMicrosoft.Security/alerts

Bseverity == 'High'

CMicrosoft.Security/automations/runPlaybook

DMicrosoft.Security/pricings

Attempts:

3 left

💡 Hint

Common Mistakes

Using incorrect resource types for trigger or action.

Not filtering alerts by severity.

The trigger is on security alerts, the condition filters for high severity, and the action runs a playbook automation.