Question

A financial services organization is building its Azure security program using the Microsoft Cloud Security Benchmark (MCSB) as the control framework. The CISO wants to ensure the organization can respond effectively to security incidents in Azure. She asks the security architect which MCSB Incident Response (IR) preparation activities should be established BEFORE any incident occurs. Which recommendation aligns with the MCSB Incident Response control domain's preparation guidance?

Accepted Answer

Create an incident response plan and process, then test it periodically, and pre-configure automated notification and workflow integration between Microsoft Defender for Cloud alerts and the SOC's ticketing/SIEM tooling.

Answer

Wait until the first high-severity alert is triaged, then draft the response runbook based on the specifics of that incident to ensure it reflects real conditions.

Answer

Rely exclusively on Microsoft's shared responsibility to detect and remediate incidents in Azure, since the cloud provider owns platform security.

Answer

Disable Defender for Cloud alerting in production to reduce noise and re-enable it only during active investigations to preserve analyst focus.