Exam SC-200 topic 2 question 22 discussion

Correct - A

In exam today (16 jan 2023)

It's right here: https://learn.microsoft.com/en-us/azure/defender-for-cloud/quickstart-onboard-machines?form=MG0AV3

✅ Correct Answer: D. Install the Connected Machine agent

CoPilot answer is: A The Log Analytics agent enables on-premises computers to communicate with Azure Security Center. This agent collects security data and sends it to Azure Security Center.

While installing the Log Analytics agent (A) directly can onboard machines for some Defender for Cloud capabilities via a Log Analytics workspace, the standard and more integrated modern approach is to use Azure Arc. Installing the Connected Machine agent (D) brings the server under Azure management via Arc, which then facilitates the deployment and management of Defender for Cloud components.

You need to do monitoring and then have Defender react, so A - Log Analytics (or AMA, today) is enough. You don't have to do centralized management in this question.

You need to install Azure Arc (azure connected Machine). In short this will create an azure resource representation of onpremise machine that can be partialy managed like azure resources. For instance you can run DfC Regulatory compliance.

The Connected Machine agent (Option D) is used to connect and manage machines that are hosted outside of Azure, such as on-premises or other cloud providers, through Azure Arc12. While it helps in managing these machines, it does not specifically enable the security features provided by Azure Defender. For Azure Defender to analyze and provide security recommendations, the Log Analytics agent is required. This agent collects data from your on-premises machines and sends it to Azure Monitor, which Azure Defender uses for its security analysis. So the answer is A

in order to make the Log analytics agent work, you first need the arc agent on an on-prem server (formerly connected machine agent) so D is correct. https://learn.microsoft.com/en-us/azure/defender-for-cloud/monitoring-components

Azure Defender (now named Defender for Cloud) relies on Log Analytics Agent to collect logs and enable protection of the workstations.

Question may be outdated but installing Azure Arc is the first thing to do with an on-prem server. This will ensure you can deploy Azure services like Defender and manage it from the Defender portal. Installing Log Analytics will be to view the Windows logs in a portal like Sentinel so as to be build alerts and rules from those logs. Azure Arc (previously Connected Machine agent) has to be loaded first.

This is an outdated question but don’t understand why most saying A as they answer? It makes sense D. Install the Connected Machine agent. Thoughts???

Outdated question now using arc only for defender for cloud

this is outdated

this should be D. For defender to work you need the azure arc agent (or azure connected .... agent) to make it work. Although, there IS a possibility to deploy it directly without using Arc, but that's not the point of this question.

Think many of these questions are now out of date. Log Analytics Agent is now legacy and is replaced as "Azure Monitor Agent (AMA)" - Examptopics needs to update this whole course I think. Too many things have changed names now so I would expect the exam questions to be different or updated.