AZ-500 Practice Question: Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel
Which TWO actions should you take to integrate on-premises servers with Microsoft Defender for Cloud for unified security management? (Choose two.)
⚠ Common exam trap
Candidates often confuse network connectivity (VPN) with agent-based data collection, or they mistakenly think Intune or Azure Stack HCI are valid integration methods for Defender for Cloud's hybrid security management.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Install the Log Analytics agent on each server.
The Log Analytics agent (now the Azure Monitor Agent) is required to collect security events and performance data from on-premises servers and send it to the Log Analytics workspace used by Microsoft Defender for Cloud. This enables Defender for Cloud to apply security policies, detect threats, and provide unified security management across hybrid environments.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Install the Log Analytics agent on each server.
Why this is correct
This is a correct action because the Log Analytics agent (or its successor, the Azure Monitor Agent) is required to collect security-relevant data from each server's event logs, performance counters, and syslog. Defender for Cloud correlates this data into security alerts, vulnerabilities, and compliance recommendations. Without the agent, the on-premises server would be invisible to Defender for Cloud's detection engine, so installing it is a direct prerequisite for the integration.
- ✗
Migrate the servers to Azure Stack HCI.
Why it's wrong here
Migrating servers to Azure Stack HCI is incorrect because Azure Stack HCI is an on-premises hyperconverged infrastructure platform for virtualizing workloads, not a service that connects existing servers to Defender for Cloud. Moving servers to a new virtualization platform would require a full migration and would not, by itself, enable security monitoring or data collection. That approach is disruptive and unrelated to the goal of integrating the current servers with Defender for Cloud.
- ✗
Enroll the servers in Microsoft Intune.
Why it's wrong here
Enrolling the servers in Microsoft Intune is wrong for this scenario because Intune is a cloud-based endpoint management service (MDM/MAM) focused on device compliance, app deployment, and conditional access—primarily for user devices. Intune does not forward security event logs or telemetry to Defender for Cloud for threat detection, and non-Azure Windows/Linux servers are not typically onboarded that way. Intune's security features are separate and do not create the data pipeline Defender for Cloud requires.
- ✓
Deploy the Azure Connected Machine agent (Azure Arc) on each server.
Why this is correct
This is a correct action because deploying the Azure Connected Machine agent (Azure Arc) registers each on-premises server as an Azure resource, giving it an ARM identity and enabling management through Azure policies, RBAC, and Defender for Cloud. With Arc, Defender for Cloud can apply its server plans, install the Log Analytics agent at scale, and centrally manage security posture across hybrid environments. This is the modern, recommended foundation for integrating non-Azure servers into Defender for Cloud.
- ✗
Establish a site-to-site VPN connection to Azure.
Why it's wrong here
Establishing a site-to-site VPN connection to Azure is not a correct action because a VPN only provides network connectivity between your on-premises network and Azure virtual networks. It does not install any agent, collect security data, or enable Defender for Cloud to assess the servers' security state. While a VPN can help reach private resources or management endpoints, the security integration itself relies entirely on agent-based data collection, so the VPN is neither necessary nor sufficient for this task.
Go deeper
Related to this question
About these practice questions
This AZ-500 question is part of Courseiva's 617-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.