AZ-500 Question 241
Select 3You are the security administrator for an organization running multiple Azure VMs (both Windows and Linux), an Azure SQL Database, and a Storage account with blobs and file shares. Your CFO wants to ensure that advanced threat detection is in place for all these resources. Which actions should you take to meet this requirement while minimizing manual configuration effort? (Choose three options.)
- A
Enable the Microsoft Defender for Servers plan in Microsoft Defender for Cloud across the relevant subscriptions.
- B
Enable the Microsoft Defender for Databases plan and configure Advanced Threat Protection at the Azure SQL server level.
- C
Enable the Microsoft Defender for Apps plan for your VM-based web applications.
- D
Manually install Microsoft Defender for Endpoint on each VM as a standalone deployment separate from Microsoft Defender for Cloud.
- E
Enable Microsoft Defender for Storage for the storage account to monitor suspicious activities.
Show answer and explanation
Correct answers: A, B, E
Explanation
To secure servers, databases, and storage, Microsoft Defender for Cloud offers dedicated plans for these resource types: Defender for Servers, Defender for Databases, and Defender for Storage. Enabling each plan ensures advanced threat detection and monitoring across VMs, SQL databases, and Azure Storage. Manually installing endpoint protection on every VM is unnecessary when Defender for Servers is enabled, as it automates deployment of Microsoft Defender for Endpoint. Refer to Microsoft documentation (https://learn.microsoft.com/azure/defender-for-cloud) for detailed guidance on enabling these plans and verifying proper configuration.
- A. Correct.
Correct. Enabling Microsoft Defender for Servers within Microsoft Defender for Cloud helps protect VMs across Windows and Linux, automatically installing necessary extensions (like the Defender for Endpoint agent) and providing centralized threat detection features.
- B. Correct.
Correct. Microsoft Defender for Databases (previously known as Advanced Threat Protection for SQL) must be enabled at the server (or managed instance) level to provide coverage for the databases and detect suspicious activities or potential vulnerabilities.
- C. Incorrect.
Incorrect. There is no specific 'Microsoft Defender for Apps' plan for VM-based web applications. If you need to protect web apps, you would generally enable Microsoft Defender for App Service or rely on other web application firewalls, not something labeled 'Defender for Apps.'
- D. Incorrect.
Incorrect. When you enable the Microsoft Defender for Servers plan, it automatically deploys the Defender for Endpoint sensor across your VMs, reducing the need for standalone manual installations.
- E. Correct.
Correct. Microsoft Defender for Storage monitors blob and file operations, scanning for suspicious or malicious activity. Enabling this feature at the account level helps protect data stored in your Azure Storage account.