A custom Microsoft Defender for Cloud recommendation is created from an Azure Policy definition that emits the recommendation with a custom severity

AZ-500 By islever Editorial Last updated

Implement and manage enforcement of cloud governance policies

Short answer

C Create a policy definition (custom-recommendation template) that emits the recommendation with the subscription's custom severity.

Question

You have an Azure subscription that uses Microsoft Defender for Cloud. You need to add a custom security recommendation to Defender for Cloud. The recommendation must be assigned the custom severity rating of the subscription. What should you create?
  1. an exemption
  2. an initiative definition
  3. a policy definition Correct Answer
  4. an assignment

Key Takeaways

Defender for Cloud recommendations are surfaced through Azure Policy; to add a new custom recommendation you author a policy definition, not an exemption, initiative, or assignment. The severity is set on the policy definition.

Custom Defender for Cloud recommendations are backed by Azure Policy. You create a policy definition (typically from the 'Configure a custom recommendation' template) that evaluates your environment and emits a recommendation carrying the custom severity you assign at the subscription scope.

Common mistake: People pick 'initiative definition' or 'assignment', but a custom recommendation is the policy definition itself; initiatives group policies and assignments apply them, neither creates a new recommendation type.

Expert Analysis

Why the Answer Is Correct

Microsoft Defender for Cloud builds its recommendations on Azure Policy. Adding a custom recommendation means creating a policy definition (from the custom-recommendation template) that produces the recommendation and carries your chosen custom severity rating. (Option C)

Why the Other Options Are Wrong

  • Option A (Exemption) excludes a resource from an existing policy; it does not create a recommendation.
  • Option B (Initiative definition) groups existing policy definitions but does not itself define a new recommendation.
  • Option D (Assignment) applies an existing policy/initiative to a scope; it does not author a new recommendation.

Community Comment Notes

Comments confirmed C and linked the Defender for Cloud create-custom-recommendations article, noting recommendations are 'based on Azure Policy.'

Official Reference

https://learn.microsoft.com/en-us/azure/defender-for-cloud/create-custom-recommendations

This link opens the official vendor documentation in a new tab.

Community Votes

C
100%

100% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 5 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 5

  1. Nava702 👍 4 Answered C
    Policy definition seems to be the correct answer.
  2. chiquito 👍 3
    Correct Answer: C A policy definition Reference: https://learn.microsoft.com/en-us/azure/defender-for-cloud/create-custom-recommendations
  3. JaridB 👍 2 Answered C
    C. a policy definition is the correct answer
  4. mrt007 👍 2
    C. a policy definition is correct
  5. randy0077 👍 1 Answered C
    correct: https://learn.microsoft.com/en-us/azure/defender-for-cloud/create-custom-recommendations#:~:text=recommendations%20based%20on-,Azure%20Policy.,-Review%20support%20in

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Entra Permissions Management Highly Privileged Roles

S-grade

Restricting AKS API server access to specific networks is done with authorized IP address ranges

S-grade

Cross-tenant access settings for B2B collaboration apply only to Microsoft Entra ID tenants, not to Google or Microsoft accounts

S-grade

Creating an allow list of a partner's cloud apps for your users is configured via Outbound access settings in Cross-tenant access settings

S-grade

← Back to AZ-500 Study Guide