2.4.4. Defender for Cloud Network Recommendations
Network Watcher answers "is this flow working?". Microsoft Defender for Cloud answers "is this design safe?", and the exam expects you to know which of its three surfaces to reach for.
| Surface | The question it answers | A typical network finding |
|---|---|---|
| Secure Score | How well does my estate follow the baseline recommendations, expressed as one score? | "Subnets should be associated with a network security group", "Management ports should be closed" |
| Attack path analysis | Which chains of findings combine into a route an attacker could actually walk? | An internet-exposed VM with an open management port that can reach a database holding sensitive data |
| Cloud Security Explorer | Which resources match a condition I want to query right now? | "Show me every VM reachable from the internet on port 3389" |
The distinction that gets tested is between the first two: Secure Score ranks recommendations individually, while attack path analysis connects them. An exposed management port and an unencrypted database are two moderate findings on their own. The attack path is the observation that one leads to the other, which is why a path is usually ranked far above the sum of its parts.
💡 First Principle: Secure Score is a scorecard, attack path analysis is a narrative, and Cloud Security Explorer is a search box. Match the verb in the question stem — score, chain, or find.
