AZ-500 Question 238
Single answerYou are a security engineer at Contoso, responsible for protecting newly created Windows and Linux virtual machines in Azure. You want to ensure that the Microsoft Defender for Cloud workload protection services (including threat detection and vulnerability assessment) are automatically installed and configured for all new VMs across several subscriptions. Which action should you take in Microsoft Defender for Cloud to accomplish this goal?
- A
Enable auto-provisioning of Microsoft Defender for Servers within Environment settings and select the required agents and extensions
- B
Manually install Microsoft Defender for Cloud extensions on each VM using a custom script when provisioning
- C
Disable advanced security policies to reduce the number of extensions required by new deployments
- D
Configure a Resource Manager template that deploys only the Azure Monitor Agent without enabling any security plans
Show answer and explanation
Correct answer: A
Explanation
By enabling auto-provisioning of Microsoft Defender for Cloud agents in the Environment (or subscription) settings, you ensure that each new VM automatically receives the necessary security extensions for advanced threat protection and vulnerability assessment. This approach adheres to Microsoft’s recommended best practices, as documented in the official Microsoft Defender for Cloud documentation (https://learn.microsoft.com/azure/defender-for-cloud). Auto-provisioning streamlines administration across multiple subscriptions and eliminates the need for manual deployment scripts.
- A. Correct.
Correct. Enabling auto-provisioning in Microsoft Defender for Cloud’s Environment settings ensures the required agents and extensions (such as the Azure Monitor Agent or Log Analytics agent) are automatically installed on all new VMs. You can also select the 'Defender for Servers' plan under 'Coverage' to provide advanced threat protection and vulnerability assessment.
- B. Incorrect.
Incorrect. While manual installation can work, it is not the best practice in large or dynamic environments. Auto-provisioning was specifically designed to simplify and centralize the deployment of security agents.
- C. Incorrect.
Incorrect. Disabling advanced security policies would prevent the workload protection services from being installed automatically, which is the opposite of what is required.
- D. Incorrect.
Incorrect. Simply deploying the Azure Monitor Agent without enabling any Defender for Servers plan will not provide the full range of protection features (including threat detection and vulnerability assessment).