AZ-500 Question 247
Select 2Your organization is using Microsoft Defender for Servers Plan 2 to manage vulnerabilities on Azure virtual machines. Several recently deployed Ubuntu VMs do not show any vulnerability data in the Microsoft Defender for Cloud portal. Upon investigation, you discover that the machines are missing the necessary agent/extension for vulnerability scanning. Which two actions should you take to ensure that these Ubuntu VMs are properly scanned by Microsoft Defender Vulnerability Management?
- A
Enable Just-in-Time (JIT) VM Access on each Ubuntu VM
- B
Install and configure the Microsoft Defender for Endpoint extension on the Ubuntu VMs
- C
Upgrade the Ubuntu OS to the latest version before assigning it to Defender
- D
Enable the built-in vulnerability assessment solution under Defender for Cloud for these VMs
Show answer and explanation
Correct answers: B, D
Explanation
To ensure Ubuntu VMs are included in Microsoft Defender Vulnerability Management, you must enable the built-in vulnerability assessment solution in Defender for Cloud and install the correct extension (Microsoft Defender for Endpoint or MDE.Linux extension). Doing both allows Defender to collect vulnerability data from the operating system. For more information, refer to the Microsoft Defender for Cloud documentation: https://learn.microsoft.com/azure/defender-for-cloud/defender-for-servers-introduction
- A. Incorrect.
Option 1 (Incorrect): Enabling JIT Access helps reduce exposure to inbound attacks by controlling inbound traffic, but it does not enable vulnerability scanning or the installation of the required agents for these VMs.
- B. Correct.
Option 2 (Correct): The Microsoft Defender for Endpoint extension (or the MDE.Linux extension) is required on Linux VMs to provide data for Microsoft Defender Vulnerability Management. Without this extension, vulnerability data may not be collected.
- C. Incorrect.
Option 3 (Incorrect): While keeping the OS updated is a good security practice, simply upgrading Ubuntu does not resolve the missing agent or provide vulnerability assessment reports to Defender. The scanning still requires a proper extension/agent to communicate.
- D. Correct.
Option 4 (Correct): Enabling the built-in vulnerability assessment solution under Defender for Cloud ensures that the necessary scanner is activated for those VMs. It complements the Defender for Endpoint extension by providing centralized vulnerability data in the portal.