Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
Microsoft Certified: Security Operations Analyst Associate · Microsoft
Select one answer.
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
I see a lot of people saying no to this one, but this one is Yes (A). Once you onboard to ARC and auto-provisioning is enabled in Defender for Cloud, Defender will check it's ARM inventory, find the Microsoft.HybridCompute/machines (Arc servers - Linux VMs) resources that were added/onboarded and collect the metadata it needs to be able to provide alert/recommendations, etc - this will satisfy the question requirement of monitoring the Linux VMs from AWS. No need for AMA / Analytics Workspace. This is done via the Azure Connected Machine agent (azcmagent), via CLI command to add/onboard to ARC. Hope you trust me, I work with these on a daily basis.
Just a clarification, the auto-provisioning basically creates a connection (understand it as a connector) with MDE (Defender for Endpoint) it's not required for MDC (Defender for Cloud) to see and monitor the VMs. The only thing needed for MDC to monitor is ARC onboarding via the Azure Connected Machine.
Azure Arc is the correct approach for onboarding non-Azure machines (like AWS or on-premises) into Azure services.