AZ-500 Question 236
Select 2You are a security administrator for a company that has multiple Azure subscriptions, all of which are monitored by Microsoft Defender for Cloud. You want to ensure that threat detection is enabled for both Windows and Linux Azure VMs and that a vulnerability assessment solution is automatically deployed on these VMs to identify potential risks. Which two configuration changes should you perform in Microsoft Defender for Cloud to meet these requirements?
- A
Enable the Defender for Servers plan in the environment settings for each subscription
- B
Turn on auto-provisioning of the integrated vulnerability assessment solution in the Defender for Cloud portal
- C
Create a custom policy initiative to install a third-party endpoint protection solution on all VMs
- D
Enable Advanced Data Security on SQL Server resources
- E
Configure Just-in-Time VM access for all Windows and Linux VMs
Show answer and explanation
Correct answers: A, B
Explanation
To configure and manage VM threat protection in Microsoft Defender for Cloud, you must enable the Defender for Servers plan and optionally configure auto-provisioning of a vulnerability assessment solution (e.g., built-in Qualys). This setup provides continuous threat monitoring and automatic deployment or enforcement of relevant extensions. See Microsoft documentation on 'Enable Microsoft Defender for Servers' and 'Auto-provision the integrated vulnerability assessment solution' for detailed configuration steps.
- A. Correct.
Correct. Enabling the Defender for Servers plan activates advanced threat protection for Windows and Linux VMs. This plan includes features such as threat detection and security recommendations.
- B. Correct.
Correct. Turning on auto-provisioning of the vulnerability assessment solution ensures that the necessary Qualys extension (or equivalent) is automatically deployed, allowing you to detect and remediate vulnerabilities on your VMs.
- C. Incorrect.
Incorrect. While you could create a custom policy initiative to install a third-party solution, this is neither necessary nor the recommended approach for enabling Microsoft Defender for Cloud’s built-in threat protection and vulnerability assessment features.
- D. Incorrect.
Incorrect. Advanced Data Security is specific to SQL Server resources (such as Azure SQL Database or SQL on Azure VMs), not to the VM operating system environment itself. It does not provide VM-level threat detection or vulnerability scans for the OS layer.
- E. Incorrect.
Incorrect. Just-in-Time (JIT) VM access regulates inbound network connections to VMs by restricting management ports. This feature helps reduce attack surfaces but does not enable automatic threat detection or vulnerability assessment for the VMs.