A. Onboard the virtual machines to Microsoft Defender for Endpoint ✅
D. Enable the Qualys scanner in Defender for Cloud ✅
Explanation
To resolve security and vulnerability issues on virtual machines:

• A. Onboard the virtual machines to Microsoft Defender for Endpoint ✅

• This provides endpoint detection and response (EDR), threat protection, and security monitoring for the VMs.

• D. Enable the Qualys scanner in Defender for Cloud ✅

• Qualys performs vulnerability assessments and identifies missing patches, security misconfigurations, and other vulnerabilities.

Why the others are incorrect

• B. Onboard the virtual machines to Azure Arc ❌

• Azure Arc enables management of hybrid and multi-cloud resources but does not directly address vulnerability assessment or endpoint protection.

• C. Create a device compliance policy in Microsoft Endpoint Manager ❌

• Compliance policies are primarily for managed user devices and do not resolve VM vulnerability assessment issues.

✅ Final Answer: A and D.

The requirement is to scan application code and meet application development security requirements.
GitHub Advanced Security provides:

• Code scanning to detect security vulnerabilities in source code.

• Secret scanning to identify exposed credentials, keys, and tokens.

• Dependency scanning to find vulnerable open-source packages.

• Security analysis integrated directly into the development workflow.

Why the others are incorrect

• A. Azure Key Vault ❌

• Stores and manages secrets, certificates, and encryption keys; it does not scan code.

• C. Application Insights in Azure Monitor ❌

• Monitors application performance and usage after deployment.

• D. Azure DevTest Labs ❌

• Provides development and testing environments but does not perform code security scanning.

✅ Correct Answer: B. GitHub Advanced Security.

When you need to delegate access while meeting specific security requirements, a custom RBAC role allows you to grant only the exact permissions required by the InfraSec group, following the principle of least privilege.

Why B is correct

• Provides granular permissions tailored to the group's needs.

• Prevents granting excessive access.

• Supports secure delegation of Azure resources.

Why the others are incorrect

• A. A subscription ❌

• A subscription is a billing and resource container, not a delegation mechanism.

• C. A resource group ❌

• Organizes resources but does not define permissions by itself.

• D. A management group ❌

• Used to organize subscriptions and apply governance at scale, not to define custom delegated permissions.

✅ Correct Answer: B. a custom role-based access control (RBAC) role.