Question
You have an Azure subscription named Sub1 that contains 50 virtual machines. Sub1 has Microsoft Defender for Cloud enabled.
Sub1 contains an Azure key vault named KV1 and an Azure policy that enforces storing all secrets in KV1.
Occasionally, the developers at your company store plaintext tokens and SSH private keys on the virtual machines.
You need to configure Defender for Cloud to detect plaintext secrets on the virtual machines. The solution must minimize administrative changes to the virtual machines.
How should you configure Defender for Cloud? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Explanation
Plan to enable: Defender Cloud Security Posture Management (CSPM) is one of the plans that makes machine secrets scanning available, the other being Defender for Servers Plan 2, which is not offered here. Defender for Cloud Apps focuses on SaaS applications, and Defender for Key Vault protects the vault itself rather than looking at what is stored on VM disks.
Feature to enable: Agentless machine scanning analyzes disk snapshots through cloud APIs, so it finds plaintext tokens and SSH private keys without installing anything on the virtual machines. Regulatory compliance reports posture against standards, and vulnerability assessment looks for software weaknesses rather than exposed secrets.
