AZ-500 Question 242
Single answerYou are an Azure Security Engineer for a company that recently decided to standardize on Microsoft Defender for Servers, Microsoft Defender for Databases, and Microsoft Defender for Storage. You need to ensure all newly created virtual machines, Azure SQL databases, and storage accounts are automatically protected with minimal manual intervention. Which configuration approach should you choose?
- A
Enable Microsoft Defender for Servers, Microsoft Defender for Databases, and Microsoft Defender for Storage in Microsoft Defender for Cloud’s environment settings, and enable auto-provisioning for Servers.
- B
Enable Microsoft Defender for Databases by configuring each Azure SQL database individually, manually install the Azure Monitoring Agent on each new VM, and rely on default security settings for Azure Storage.
- C
Use an Azure Policy definition to deploy extensions for Microsoft Defender for Servers, Databases, and Storage to all newly created resources and disable environment settings in Microsoft Defender for Cloud.
- D
Rely on script-based deployment: set a startup script on each VM to install the agent on boot, enable auditing in SQL databases, and periodically run scripts against all storage accounts to apply threat detection.
Show answer and explanation
Correct answer: A
Explanation
Microsoft Defender for Cloud provides a central place to enable Microsoft Defender for Servers, Microsoft Defender for Databases, and Microsoft Defender for Storage. Auto-provisioning from Microsoft Defender for Cloud (previously Azure Security Center) ensures new servers automatically have the necessary security extensions installed. Enabling Microsoft Defender for Databases and Storage from environment settings covers your databases and storage accounts with advanced threat detection without needing manual deployments. For more detailed guidance, refer to the official Microsoft documentation: https://learn.microsoft.com/azure/defender-for-cloud.
- A. Correct.
Option 1 is correct because enabling Microsoft Defender for Servers, Databases, and Storage from Microsoft Defender for Cloud’s environment settings ensures coverage is applied across the subscription. Auto-provisioning for Servers automatically installs required agents on new VMs, while enabling Defender for Databases and Storage covers those services with advanced threat protection.
- B. Incorrect.
Option 2 is incorrect because it relies on manually enabling Microsoft Defender for Databases on each Azure SQL database and installing agents on every VM. This approach increases operational overhead and is prone to errors or missed resources. Also, relying only on default storage security settings does not enable advanced threat protection for storage accounts.
- C. Incorrect.
Option 3 is incorrect because while Azure Policy can assist with resource deployments and configurations, disabling Microsoft Defender for Cloud’s environment settings prevents the unified approach for threat protection. You still need to enable the Defender plans through the environment settings to gain full security benefits and auto-provisioning for servers.
- D. Incorrect.
Option 4 is incorrect because script-based deployment is less efficient, can be complicated to maintain, and may miss resources if the script isn’t continuously updated. It does not provide a consistent or centrally managed method to enable Microsoft Defender for all relevant services.