Question

A financial services company runs public-facing web APIs across Azure App Service, AWS Elastic Beanstalk, and an on-premises Kubernetes cluster. The security architect must design a unified posture management approach that continuously assesses these heterogeneous web workloads against a consistent set of security controls (encryption in transit, minimum TLS versions, secure configuration), reports findings in a single portal, and maps them to an internal benchmark. Which design meets these requirements with the least custom tooling?

Accepted Answer

Connect AWS and on-premises resources to Defender for Cloud via multicloud connectors and Azure Arc, apply the Microsoft Cloud Security Benchmark as the default standard, and add a custom compliance standard for the internal benchmark.

Answer

Deploy separate CIS benchmark tools natively in each cloud (Azure Policy, AWS Config, and a self-hosted Kubernetes scanner) and export findings to a shared Log Analytics workspace for correlation.

Answer

Enable Defender EASM against all public endpoints and rely on its discovery inventory to enforce TLS and configuration baselines across the three environments.

Answer

Onboard only the Azure workloads to Defender for Cloud with MCSB, and manually review AWS and on-premises workloads quarterly using vendor-native security dashboards.