You manage three Azure subscriptions under a management group. Leadership wants to raise Microsoft Defender for Cloud Secure Score and track PCI DSS compliance across those subscriptions. They also want threat protection enabled for VMs and AKS clusters, using native capabilities with minimal custom policy authoring. Which two actions should you perform? Each correct answer presents part of the solution.

Enabling enhanced security features (Defender plans) for Servers and Kubernetes directly addresses the need for threat protection on VMs and AKS clusters using native capabilities. These plans integrate with Defender for Cloud to provide security recommendations and alerts, contributing to the Secure Score. Assigning the PCI DSS regulatory compliance standard in Defender for Cloud populates the regulatory compliance dashboard, allowing you to track compliance against the standard without custom policy authoring. This directly fulfills the requirement to track PCI DSS compliance. Creating a custom Azure Policy initiative for PCI DSS is unnecessary as Defender for Cloud offers native regulatory compliance dashboards. Enabling Azure Advisor security recommendations is a good practice but is not the primary driver for Secure Score or PCI DSS compliance tracking. Deploying Microsoft Sentinel for custom workbooks is an advanced option for security information and event management (SIEM) but is not the most direct or native way to track PCI DSS compliance or enhance Secure Score as requested.