Question

A financial services company runs 400 Windows and Linux servers split across on-premises datacenters, Azure, and AWS EC2. The security architect must ensure every server is continuously assessed against a hardening standard (such as CIS or the Microsoft cloud security benchmark OS baselines), with drift from the baseline reported centrally and remediation guidance surfaced, regardless of where each server runs. The solution should require the least custom tooling. Which approach should the architect specify?

Accepted Answer

Onboard the on-premises and AWS servers to Azure Arc, enable Defender for Servers Plan 2, and use the Azure Machine Configuration (guest configuration) OS baseline assessments surfaced through Defender for Cloud recommendations.

Answer

Deploy Microsoft Defender for Endpoint to all servers and rely on its device inventory and vulnerability management to enforce the CIS hardening baseline across the fleet.

Answer

Configure Azure Policy with custom deny effects on each Azure subscription and manually run CIS-CAT scans on the on-premises and AWS servers, exporting results to a shared workbook.

Answer

Enable Microsoft Defender External Attack Surface Management (EASM) to discover the servers and report configuration weaknesses against the hardening standard.