On the same Microsoft Defender for Cloud blade, the lock-lab team sees a “secure transfer required” recommendation and a “crypto-mining on VM” alert. How should the Azure security engineer treat them?
Select an answer to reveal the explanation.
Short Explanation
One is a smoke alarm, one is a house-inspection note. Jump on the crypto-mining alert like a live threat, and fix “secure transfer required” as posture work—don’t mix those lanes up.
Full Explanation
Microsoft Defender for Cloud surfaces both alerts for active threats and recommendations for posture gaps, and they must be handled differently. A crypto-mining-on-VM alert is an active threat that needs immediate response and containment; a “secure transfer required” recommendation is configuration posture that should be remediated through hardening and Secure Score work, not treated as the same class of signal.
Treating both items as posture-only recommendations and ignoring the crypto-mining entry leaves a live compromise path unaddressed while you polish TLS settings. Dismissing the crypto-mining alert first because recommendations supposedly outrank alerts reverses priority—alerts outrank recommendations when an active threat is present. Deleting the virtual machine and marking the secure-transfer recommendation as an active threat conflates blunt destruction with mislabeled posture work.
Exam caveat: the same Defender for Cloud blade can show both types side by side; exam items often test whether you separate threat response from recommendation remediation. Operational check: open the crypto-mining alert, assign an owner and begin containment on the lock-lab VM, then track the secure-transfer recommendation separately until HTTPS-only transfer is enforced on the affected storage resources.