Microsoft Security Operations AnalystMitigate threats using Microsoft Defender for CloudEasy
A security engineer is configuring Microsoft Defender for Cloud for a new Azure subscription. The engineer wants to ensure that all virtual machines provisioned in this subscription automatically have the Defender for Servers Plan 2 enabled. Which configuration method should the engineer use to achieve this?
- AConfigure auto-provisioning for the Log Analytics agent and enable Defender for Servers Plan 2 at the subscription level.
- BUse Azure Resource Manager (ARM) templates to deploy VMs with Defender for Servers Plan 2 pre-configured.
- CManually enable Defender for Servers Plan 2 for each VM after deployment.
- DCreate a custom Azure Policy that denies VM creation if Defender for Servers Plan 2 is not enabled.
Show answer & explanationAnswer & explanation
Correct answer: A. Configure auto-provisioning for the Log Analytics agent and enable Defender for Servers Plan 2 at the subscription level.
To automatically enable Defender for Servers Plan 2 for all VMs, auto-provisioning for the Log Analytics agent must be configured, and Defender for Servers Plan 2 must be enabled at the subscription level. This ensures that new and existing VMs are covered without manual intervention per VM.
Why the other options are wrong
- B. ARM templates can configure individual VMs, but auto-provisioning at the subscription level is more comprehensive for all VMs.
- C. This method is manual and does not scale for automatic provisioning.
- D. While an Azure Policy can enforce compliance, denying VM creation is overly restrictive and not the primary method for automatic enablement.
Defender for Servers Auto-Provisioning
A feature in Microsoft Defender for Cloud that automatically deploys necessary agents and enables Defender for Servers Plan 2 for all existing and new VMs within a subscription.
- Ensures widespread protection for servers.
- Requires Log Analytics agent for full functionality.
- Configured at the subscription level.
Memory trick: Auto-magic servers, always secure, no manual fuss.