AZ-500 Question 243
Select 3You are an Azure security engineer for an e-commerce company running Ubuntu-based VMs on Azure for web applications, Azure SQL databases for transactional data, and Azure Storage accounts for customer files. You have been tasked to enable Microsoft Defender threat detection and vulnerability scanning for these servers, databases, and storage accounts. Which three actions should you perform to ensure that Microsoft Defender protections are properly configured across all these resource types? (Choose three.)
- A
Enable Microsoft Defender for Servers in Microsoft Defender for Cloud and configure the necessary extension or agent on your Azure VMs.
- B
Enable Geo-Redundant Storage (GRS) for all your Azure Storage accounts to activate built-in threat protection.
- C
Enable Microsoft Defender for Databases for your Azure SQL resources in the Environment settings or at the resource level.
- D
Enable Microsoft Defender for Storage for each storage account or at the subscription level.
- E
Create a custom role with the 'Microsoft Threat Protection contributor' permission for all resource groups hosting the VMs, databases, and storage accounts.
Show answer and explanation
Correct answers: A, C, D
Explanation
To fully secure servers, databases, and storage accounts with Microsoft Defender for Cloud, you must enable the respective Microsoft Defender plans (Servers, Databases, and Storage) at the appropriate levels (subscription, workspace, or resource), and ensure VMs have the required agent installed for threat detection telemetry. Geo-Redundancy and custom RBAC roles are not prerequisites to enable Defender threat protection. For more information, refer to Microsoft Defender for Cloud documentation at https://learn.microsoft.com/azure/defender-for-cloud.
- A. Correct.
Correct. When you enable Microsoft Defender for Servers, you get real-time threat detection and vulnerability management for your VMs. This also involves installing the Azure Monitor agent or Microsoft Defender extension on each VM to collect security data.
- B. Incorrect.
Incorrect. Geo-Redundant Storage (GRS) is a replication strategy, not a requirement for enabling Microsoft Defender threat detection. Threat protection for storage can be enabled regardless of the replication setting.
- C. Correct.
Correct. Microsoft Defender for Databases (formerly Azure Defender for SQL) can be enabled in Microsoft Defender for Cloud’s Environment settings or directly within the Azure SQL resource. This provides threat detection, vulnerability assessments, and alerts.
- D. Correct.
Correct. Microsoft Defender for Storage offers threat protection for your Azure Storage accounts. You can enable it per storage account or centrally through Microsoft Defender for Cloud.
- E. Incorrect.
Incorrect. There is no built-in 'Microsoft Threat Protection contributor' role, and creating a custom role is not a mandatory step for turning on threat detection. Configuring the relevant Defender plans is sufficient to enable security alerts and recommendations.