Knowledge check

1.

A security team wants to prevent any extensions except the Microsoft Defender for Endpoint extension from being installed on Arc-enrolled servers—even if a privileged Azure user approves the installation. Which control achieves this protection that Azure Policy alone can't provide?

Azure Policy with Deny effect assigned at management group scope

Resource lock on the Arc server resource in Azure

The allow list for the extension, is configured on the Azure Connected Machine agent

2.

An organization uses Azure Arc to manage on-premises servers. A team member needs to onboard new servers to Arc but must not be able to modify existing server configurations or install extensions. Which built-in role should be assigned?

Azure Connected Machine Resource Administrator

Azure Connected Machine Onboarding

Contributor

3.

After Arc-enrolling Contoso Manufacturing's on-premises servers, a security engineer checks Microsoft Defender for Cloud and sees the servers listed in security recommendations. What does this confirm?

The servers are fully protected by Defender for Servers Plan 2 and all capabilities are active

The Azure Connected Machine agent is installed and the servers are visible to Defender for Cloud's posture assessment

The servers require the Log Analytics agent before Defender for Cloud can assess them

Check your knowledge

Feedback