hardMultiple Choice
SC-100 Practice Question: Uses Microsoft Defender for Cloud to secure their…
An organization uses Microsoft Defender for Cloud to secure their multi-cloud environment, including Azure and AWS. They want to ensure that all AWS EC2 instances are automatically onboarded to Defender for Cloud. What should they configure?
⚠ Common exam trap
Watch out — candidates often confuse the AWS connector (a cloud-to-cloud integration) with Azure Arc (a hybrid management tool), assuming Arc is required for any non-Azure workload, when in fact the connector handles automatic onboarding without per-instance configuration.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Set up the AWS connector in Defender for Cloud
The AWS connector in Microsoft Defender for Cloud is the native integration that enables automatic discovery and onboarding of AWS resources, including EC2 instances, into Defender for Cloud. Once configured, the connector uses AWS IAM roles and APIs to continuously sync EC2 inventory and apply Defender plans (e.g., Defender for Servers) without requiring manual agent installation on each instance.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Deploy Azure Arc on each EC2 instance
Why it's wrong here
Deploying Azure Arc on each EC2 instance is incorrect for this scenario because Azure Arc requires the Connected Machine agent to be manually installed on every instance before it can be managed; it does not perform native discovery or automatic onboarding of AWS resources. Microsoft Defender for Cloud's AWS connector is purpose-built to discover EC2 instances without per-instance manual setup, so this approach adds operational overhead and still does not itself provide Defender security assessments.
- ✗
Use AWS Systems Manager to push Defender workload
Why it's wrong here
AWS Systems Manager is an AWS-native management service for patch baselines, Run Command, and State Manager, but it has no integration or capability to deploy or push Microsoft Defender for Cloud workloads onto EC2 instances. Defender for Cloud has its own agents (e.g., Azure Monitor Agent, Defender plans) and a dedicated multicloud connector path; there is no Systems Manager document or API that can install Defender extensions. Relying on Systems Manager would leave the workload unprotected by Defender.
- ✓
Set up the AWS connector in Defender for Cloud
Why this is correct
Setting up the AWS connector in Microsoft Defender for Cloud is the correct action because the connector uses an AWS cross-account IAM role to automatically discover and monitor EC2 instances along with other AWS resources, bringing them into Defender’s Cloud Security Posture Management (CSPM) and workload protection plans. Once connected, Defender can apply Azure Policy-based recommendations, integration with Azure Arc for hybrid management, and threat detection without needing to manually install anything on each instance.
- ✗
Configure AWS Config rules to report to Defender
Why it's wrong here
AWS Config rules provide compliance checks within AWS against resource configurations, but they are not an onboarding mechanism for Microsoft Defender for Cloud; there is no event subscription or reporting channel that forwards AWS Config results into Defender. The only supported integration path is the AWS connector in Defender for Cloud, which uses resource APIs and IAM roles rather than Config. Creating Config rules would give you AWS-native compliance data only, not Defender recommendations or security monitoring.
Go deeper
Related to this question
About these practice questions
One of 605 original SC-100 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-100 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-100 exam.