Question 1,287 of 209
hardMultiple ChoiceObjective-mapped
SC-200 Practice Question: Is configuring Microsoft Defender for Cloud in a…
A security engineer is configuring Microsoft Defender for Cloud in a hybrid environment that includes on-premises servers connected via Azure Arc. The engineer wants to enable the Defender for Cloud plans for servers (including vulnerability assessment) on all Azure Arc-enabled machines. What is the correct method to deploy the Log Analytics agent (or Azure Monitor Agent) and the Microsoft Defender for Endpoint (MDE) integration?
⚠ Common exam trap
Candidates often assume manual agent installation (Option A) or Update Management (Option C) are valid for Defender for Cloud integration, but the exam tests the understanding that Azure Policy is the only scalable, compliant method to deploy both AMA and MDE extensions on Arc machines while enabling Defender for Cloud plans automatically.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable Azure Policy 'Configure Azure Arc machines to run Azure Monitor Agent' with a DeployIfNotExists policy that also installs the MDE extension.
It leverages Azure Policy with a DeployIfNotExists effect to automatically deploy the Azure Monitor Agent (AMA) and the Microsoft Defender for Endpoint (MDE) extension on Azure Arc-enabled servers. This ensures compliance at scale without manual intervention, and it is the recommended method in Defender for Cloud for hybrid machines. The policy also handles the vulnerability assessment integration by enabling the Defender for Cloud plans for servers.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Manually install the agents on each server via Group Policy.
Why it's wrong here
Manually deploying agents through Group Policy is operationally fragile: it relies on custom startup scripts or MSI packaging, does not register deployment status with Azure, and provides no DeployIfNotExists remediation loop or compliance reporting. In a hybrid environment, machines not joined to the domain or offline at GPO refresh are silently missed, and the approach cannot automatically enforce the MDE extension that Defender for Cloud's server plans require.
- ✓
Enable Azure Policy 'Configure Azure Arc machines to run Azure Monitor Agent' with a DeployIfNotExists policy that also installs the MDE extension.
Why this is correct
The built-in Azure Policy DeployIfNotExists initiative 'Configure Azure Arc machines to run Azure Monitor Agent' automatically provisions the Azure Monitor Agent and the Microsoft Defender for Endpoint extension on every Azure Arc-enabled machine at assignment scope. It gives Defender for Cloud a continuous compliance signal, remediates noncompliant machines without human intervention, and ensures MDE is present for unified endpoint detection and response alongside Defender for Cloud's server plans.
- ✗
Use the Azure Automation Update Management to deploy agents.
Why it's wrong here
Azure Automation Update Management is a patching solution, not an agent deployment mechanism; it uses the Log Analytics agent to assess and install OS updates but never provisions the MDE extension or the AMA data collection tier. Relying on it would leave the endpoint protection agent absent, so Defender for Cloud's vulnerability and threat detection would still lack the EDR sensor even if patch compliance is reported.
- ✗
Enable the 'Log Analytics agent for Windows' extension on each Arc machine via Azure Arc management.
Why it's wrong here
Simply enabling the 'Log Analytics agent for Windows' extension installs the legacy OMS/MMA agent, which collects security events but does not deploy the Microsoft Defender for Endpoint extension required for Defender for Cloud's unified endpoint protection. The legacy agent is also being superseded by Azure Monitor Agent, so this action alone leaves the machine without the MDE sensor and would not satisfy the DeployIfNotExists policy that enforces the correct agent stack.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SC-200
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A security engineer is configuring Microsoft Defender for Cloud in a hybrid environment with on-premises servers connected via Azure Arc. The engineer wants to enable the Defender for Cloud plans for servers (including vulnerability assessment) on all Azure Arc-enabled machines. What is the correct method to deploy the Log Analytics agent (or Azure Monitor Agent) and the Microsoft Defender for Endpoint (MDE) integration?
easy- A.Manually install the Log Analytics agent on each machine and then enable MDE integration
- ✓ B.Use the Defender for Cloud auto-provisioning feature with the Azure Policy 'Deploy Log Analytics agent' and enable MDE integration
- C.Use Azure Arc extensions to install the agents and then configure Defender for Cloud plans
- D.Deploy the agents via Configuration Manager
Why B: Defender for Cloud's auto-provisioning feature uses built-in Azure Policy initiatives to automatically deploy the Log Analytics agent (or Azure Monitor Agent) to Azure Arc-enabled machines. Separately, enabling the Microsoft Defender for Endpoint (MDE) integration from Defender for Cloud's environment settings deploys MDE to supported machines, including Arc-enabled ones. This ensures consistent, scalable deployment without manual intervention, aligning with the hybrid environment's requirements.
Last reviewed: Jun 11, 2026
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.