Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
Microsoft Certified: Security Operations Analyst Associate · Microsoft
Select one answer.
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
it's NO (B). You don't need LAW or AMA installed to have Defender for Cloud collect the metadata it needs for it's monitoring. The Connected Machine Onboarding agent is what it will use to get that data and bring it to ARC - basically creating an entry of that VM identity in ARM as Microsoft.HybridCompute where Defender (with auto-provisioning enabled) will find it and see it as an Azure resource, applying the same logic for monitoring as it would for any native Azure VM. The onboarding is done via CLI with the azcmagent specific command regardless of Windows or Linux, from onprem or other cloud provider.
Just a clarification, the auto-provisioning basically creates a connection (understand it as a connector) with MDE (Defender for Endpoint) it's not required for MDC (Defender for Cloud) to see and monitor the VMs. The only thing needed for MDC to monitor is ARC onboarding via the Azure Connected Machine.
This is a hard one. In theory it will work only with the Log Analytics agent, but it's not the best practice is these modern times. Some answers are pretty old (almost 4 years) and it that time the answer was yes. So I stay with yes.