AZ-500 Question 237
Select 2You manage an Azure environment with multiple subscriptions. You recently noticed that newly created virtual machines in one subscription are not being scanned for vulnerabilities or protected by advanced threat detection in Microsoft Defender for Cloud. You need to ensure that every new VM in that subscription is automatically enrolled in Microsoft Defender for Cloud’s protection, including installing the necessary agents for threat detection and vulnerability assessment. Which two actions should you take within Microsoft Defender for Cloud to achieve this?
- A
Enable the Defender for Servers plan for the subscription in Microsoft Defender for Cloud’s Environment settings.
- B
Configure a custom alert rule in Microsoft Sentinel to detect new virtual machines.
- C
Enable auto-provisioning of the integrated vulnerability assessment and monitoring agent in the subscription’s Environment settings.
- D
Create a continuous export rule in Microsoft Defender for Cloud to send alerts to a Log Analytics workspace.
Show answer and explanation
Correct answers: A, C
Explanation
To ensure newly created virtual machines are protected by Microsoft Defender for Cloud, you must first enable the relevant Defender plan (e.g., Defender for Servers) and configure auto-provisioning of the necessary agents in the Environment settings for that subscription. By doing so, all new VMs will automatically receive advanced threat detection and vulnerability assessment. For more details, refer to Microsoft's documentation on configuring Microsoft Defender for Cloud auto-provisioning (https://learn.microsoft.com/azure/defender-for-cloud/enable-auto-provisioning) and enabling plans (https://learn.microsoft.com/azure/defender-for-cloud/defender-for-cloud-enabling).
- A. Correct.
Correct. To protect newly created virtual machines, you must enable (or upgrade to) the Defender for Servers plan in Microsoft Defender for Cloud so that advanced threat protection and vulnerability management are available.
- B. Incorrect.
Incorrect. Although Microsoft Sentinel can create custom alert rules, simply configuring a rule does not automatically deploy the necessary agents or enable Defender for Servers. Sentinel is a separate service and doesn't replace enabling the Defender plan.
- C. Correct.
Correct. When you enable auto-provisioning in Microsoft Defender for Cloud, it automatically deploys the required monitoring and vulnerability assessment agents to newly created VMs, ensuring immediate protection and scanning.
- D. Incorrect.
Incorrect. Continuous export is used to forward alerts and assessments to external sources (e.g., a Log Analytics workspace) for monitoring or analysis. It does not automate agent deployment or enable the subscription’s Defender plan.