A financial services company runs production workloads across Azure and AWS. Security architects need a Defender for Cloud design that: (1) applies the Microsoft Cloud Security Benchmark to both clouds, (2) provides agentless discovery of exposed secrets stored on VM disks and in container environments, and (3) flags a scored regulatory gap when a storage account or S3 bucket allows public network access. The team wants to minimize the number of Defender plans they must enable while still meeting all three requirements. Which combination of Defender for Cloud capabilities should they enable?