You receive a security alert in Microsoft Defender for Cloud as shown in the exhibit. (Click the Exhibit tab.) After remediating the threat which policy definition should you assign to prevent the…

The correct answer is C. Storage accounts should prevent shared key access. You should read Microburst toolkit - it is an open-source tool. Find Get-AZStorageKeysREST.ps1 it tries to enumerate all storage accounts then the respective storage keys. There is nothing to do with anonymous access here. Even if a storage account allows public access you…

Design security operations, identity, and compliance capabilities

Question

You receive a security alert in Microsoft Defender for Cloud as shown in the exhibit. (Click the Exhibit tab.) After remediating the threat which policy definition should you assign to prevent the threat from reoccurring?

Exhibit

Options

AStorage account public access should be disallowed
BAzure Key Vault Managed HSM should have purge protection enabled
CStorage accounts should prevent shared key access
DStorage account keys should not be expired

How the community answered

(46 responses)

A
4% (2)
B
7% (3)
C
74% (34)
D
15% (7)

Explanation

You should read Microburst toolkit - it is an open-source tool. Find Get-AZStorageKeysREST.ps1 it tries to enumerate all storage accounts then the respective storage keys. There is nothing to do with anonymous access here. Even if a storage account allows public access you can't get the key without being authenticated and authorized. The preventive control here is to manage Shared Key Authorization.

Topics

#Azure Policy#Storage Account Security#Shared Key Access

Community Discussion

No community discussion yet for this question.

Full SC-100 Practice