AZ-500 Question 239
Select 2You manage an Azure environment hosting both Windows and Linux virtual machines. Currently, they are covered only by the free tier in Microsoft Defender for Cloud. You want to enable advanced threat detection and vulnerability assessment across these VMs. Which two tasks should you perform to properly enable workload protection services for these machines?
- A
Upgrade the subscription from the free tier to Microsoft Defender for Servers (or the standard plan) under 'Environment settings' in Microsoft Defender for Cloud.
- B
Enable auto provisioning of the required monitoring agent from the 'Auto provisioning' blade in Microsoft Defender for Cloud.
- C
Install the Microsoft Antimalware extension on the Windows VMs only and skip onboarding for Linux VMs.
- D
Modify inbound rules in the network security group to allow port 80 traffic from AzureCloud for the VMs.
Show answer and explanation
Correct answers: A, B
Explanation
To enable workload protection services in Microsoft Defender for Cloud, you must first upgrade from the free tier to the Defender for Servers plan (or the standard plan). Then, auto-provision the necessary monitoring extensions to Windows and Linux virtual machines. Skipping plan upgrade or failing to auto-provision the extension will prevent advanced threat protection features from functioning across your workloads. For more details, see Microsoft Defender for Cloud documentation on enabling Defender plans and auto-provisioning agents.
- A. Correct.
Correct. To utilize Microsoft Defender for Cloud’s advanced features, such as threat protection and vulnerability assessments, you must upgrade your subscription from the free tier to Microsoft Defender for Servers (or the standard plan) under the 'Environment settings'. This is a required step to enable workload protection services.
- B. Correct.
Correct. After upgrading to the appropriate Defender plan, you should enable 'Auto provisioning' to automatically deploy the needed security monitoring agent (Azure Monitor Agent or related extension) to Windows and Linux VMs. This ensures the workload protection services are fully active.
- C. Incorrect.
Incorrect. Installing the Microsoft Antimalware extension on Windows VMs alone does not provide the full threat protection and vulnerability assessment capabilities for Linux VMs. Both operating systems require proper agent deployment under the upgraded Defender plan.
- D. Incorrect.
Incorrect. Adjusting inbound security rules does not enable advanced threat protection or vulnerability assessment. Proper subscription plan upgrades and agent deployments are required for comprehensive workload protection.