Microsoft Defenders for Cloud's adaptive application controls enhance your security with this data-driven, intelligent automated solution that defines allowlists of known-safe applications for your machines.
Often, organizations have collections of machines that routinely run the same processes.
Microsoft Defender for Cloud uses machine learning to analyze the applications running on your machines and create a list of the known-safe software. Allowlists are based on your specific Azure workloads, and you can further customize the recommendations.
Note: Defender for Cloud needs at least two weeks of data to define the unique recommendations per group of machines. Machines that have recently been created, or which belong to subscriptions that were only recently protected by Microsoft Defender for Servers, will appear under the No recommendation tab.
Reference:
https://learn.microsoft.com/en-us/azure/defender-for-cloud/enable-adaptive-application-controls

Explanation:
Box 1: Microsoft Defender for Servers Plan 2
Incorrect:
* An Azure Automation account
Update Manager offers many new features and provides enhanced and native functionalities.
Following are some of the benefits:
* Provides native experience with zero on-boarding.
- No dependency on Log Analytics and Azure Automation.
- Etc.
* Etc.
Box 2: Azure connected machine agent
For the Azure Update Manager, both AMA and MMA aren't a requirement to manage software update workflows as it relies on the Microsoft Azure VM Agent for Azure VMs and Azure connected machine agent for Arc-enabled servers.
Reference:
https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers-select-plan
https://learn.microsoft.com/en-us/azure/update-manager/overview
https://learn.microsoft.com/en-us/azure/update-manager/migration-overview

Explanation:
Customer-managed keys for Azure Storage encryption
With an Azure Storage account, an Azure key vault, and Customer-managed keys, how to define access policies?
Step 1: Configure Azure Storage encryption with customer-managed keys.
Configure customer-managed keys in the same tenant for an existing storage account Configure the key vault You can use a new or existing key vault to store customer-managed keys.
Using customer-managed keys with Azure Storage encryption requires that both soft delete and purge protection be enabled for the key vault. Soft delete is enabled by default when you create a new key vault and cannot be disabled. You can enable purge protection either when you create the key vault or after it is created.
To enable purge protection on an existing key vault, follow these steps:
Navigate to your key vault in the Azure portal.
Under Settings, choose Properties.
In the Purge protection section, choose Enable purge protection.
Step 2: Create and assign a Key Vault access policy.
Azure Key Vault supports authorization with Azure RBAC via an Azure RBAC permission model.
Microsoft recommends using the Azure RBAC permission model over key vault access policies.
But here we use an access policy for the Key Vault.
Step 3: Create a managed identity and assign it to AKV1.
Add a key [Done]
After creating a Key Vault [Done], add a key to the key vault. Before you add the key, make sure that you have assigned to yourself the Key Vault Crypto Officer role.
Azure Storage encryption supports RSA and RSA-HSM keys of sizes 2048, 3072 and 4096.
Choose a managed identity to authorize access to the key vault [Step 1] When you enable customer-managed keys for an existing storage account, you must specify a managed identity to be used to authorize access to the key vault that contains the key. The managed identity must have permissions to access the key in the key vault.
Reference:
https://learn.microsoft.com/en-us/azure/storage/common/customer-managed-keys-configure- existing-account

https://learn.microsoft.com/en-us/defender-cloud-apps/use-case-proxy-block-session-aad#create- a-block-download-policy-for-unmanaged-devices Defender for Cloud Apps session policies allow you to restrict a session based on device state.
To accomplish control of a session using its device as a condition, create both a conditional access policy AND a session policy.