Question

A retail company runs a customer-facing web application on Azure App Service, with backend microservices on Azure Kubernetes Service and product data in Azure SQL Database. The security architect must design continuous posture management that measures the environment against a vendor-neutral baseline of foundational security controls (identity, network, data protection, logging), automatically reflects new Azure resources as they are deployed, and produces prioritized remediation guidance mapped to control domains. Which approach best meets these requirements with the least custom engineering?

Accepted Answer

Enable Microsoft Defender for Cloud with the Microsoft Cloud Security Benchmark (MCSB) as the default assessment standard and use Secure Score recommendations for remediation prioritization.

Answer

Author a custom Azure Policy initiative from scratch that maps to each MCSB control and assign it at the subscription scope.

Answer

Deploy Microsoft Defender External Attack Surface Management (EASM) to continuously discover internet-facing assets and score their exposure.

Answer

Onboard all resources to Azure Arc and apply machine configuration baselines to each server and container host.