4 of the 17 questions we have for this objective, shown with the answer and the reasoning.
Design solutions for security posture management in hybrid and multicloud environments
Larkspur Manufacturing runs 120 Azure virtual machines in a subscription named Prod-Plant. Security requires endpoint detection and response from Microsoft Defender for Endpoint, file integrity monitoring on registry and system files for PCI DSS, and just-in-time access to management ports. The team wants a single Defender for Cloud plan that delivers all three capabilities.
Which plan should you recommend?
- ADefender for Servers Plan 1Plan 1 integrates Defender for Endpoint for EDR and vulnerability findings, but it does not include file integrity monitoring or just-in-time VM access.
- BDefender for Servers Plan 2Plan 2 includes everything in Plan 1 plus file integrity monitoring, just-in-time VM access, agentless scanning, and a daily free data ingestion allowance, meeting all three requirements in one plan.
- CDefender CSPMDefender CSPM is a posture plan with agentless scanning and attack paths; it does not deploy Defender for Endpoint, monitor file integrity, or provide just-in-time access.
- DDefender for Resource ManagerDefender for Resource Manager monitors control-plane operations across the subscription; it has no endpoint agent, file integrity, or port-management capability.
Why: Selecting the right Defender for Servers plan is a recurring architect decision: Plan 1 is essentially Defender for Endpoint delivered through Defender for Cloud, while Plan 2 adds the server-specific controls such as file integrity monitoring, just-in-time VM access, agentless scanning, and free log ingestion. The deciding constraint here is the explicit need for FIM and JIT, both of which are Plan 2 features. The trap is Plan 1, which satisfies the EDR requirement and is cheaper but silently fails the other two.
Design solutions for security posture management in hybrid and multicloud environments
Bramblewood Hospitality has 250 Windows Server and Ubuntu servers in a colocation facility that will stay on-premises for at least five years. The security team wants these servers to appear in Azure Resource Manager so they can receive Azure Policy machine configuration assignments, Defender for Cloud recommendations, and Azure RBAC, managed the same way as Azure VMs. There is no plan to migrate the workloads.
What should you recommend?
- AOnboard the servers as Azure Arc-enabled servers by installing the Azure Connected Machine agentArc-enabled servers project non-Azure machines into Azure Resource Manager as first-class resources, enabling Azure Policy machine configuration, Defender for Cloud, RBAC, tags, and extensions without migrating the workload.
- BUse Azure Migrate to discover and assess the serversAzure Migrate is a discovery and migration tool; it does not make servers governable by Azure Policy or Defender for Cloud while they stay on-premises.
- CDeploy Azure Local (formerly Azure Stack HCI) in the colocation facility and rebuild the servers on itAzure Local is an Arc-enabled hyperconverged platform that would require rebuilding the workloads on new hardware, far more than the requirement to govern the existing servers.
- DInstall the Azure Monitor agent directly on each server and send logs to a Log Analytics workspaceOutside Azure, the Azure Monitor agent itself requires the server to be Arc-enabled; on its own the agent provides logging, not Resource Manager representation, RBAC, or policy.
Why: Azure Arc is the control-plane extension that makes servers running anywhere (on-premises, AWS, GCP, or edge) manageable through Azure Resource Manager. Once a server is Arc-enabled it has an Azure resource ID, so Azure Policy machine configuration, Defender for Cloud, RBAC, and VM extensions apply exactly as they do to Azure VMs. The deciding constraint is governance without migration, which eliminates Azure Migrate and a platform rebuild. The trap is the Azure Monitor agent option: on non-Azure machines it is deployed as an Arc extension, so Arc is a prerequisite rather than an alternative.
Design solutions for security posture management in hybrid and multicloud environments
Veridian Mobility publishes 85 REST APIs to partners through an Azure API Management instance named apim-partners. Security wants an inventory of the published APIs, detection of unauthenticated or externally exposed endpoints that handle sensitive data, and runtime alerts for OWASP API Top 10 patterns such as broken object level authorization probing. The back-end services run in Azure Container Apps.
Which Defender for Cloud plan should you recommend?
- ADefender for App ServiceDefender for App Service protects App Service web apps and plans; it does not inventory or analyze APIs published through API Management.
- BDefender for APIs enabled on the subscription that contains apim-partners, with the APIs onboardedDefender for APIs integrates with API Management to build an API inventory, flag unauthenticated or externally exposed APIs that carry sensitive data, and detect OWASP API Top 10 style runtime anomalies.
- CDefender for Resource ManagerDefender for Resource Manager watches Azure control-plane operations, not the data-plane traffic flowing through API endpoints.
- DAzure Web Application Firewall on an Application Gateway in front of apim-partnersWAF blocks known request patterns at the edge, but it does not provide API inventory, sensitive data classification, or Defender for Cloud posture recommendations for the APIs.
Why: Defender for APIs is the workload protection plan built specifically for APIs fronted by Azure API Management; it discovers the inventory, classifies which endpoints are exposed or unauthenticated while handling sensitive data, and uses machine learning to detect OWASP API Top 10 style abuse at runtime. The deciding constraints are inventory plus posture plus runtime alerts, which no other plan combines for APIs. The trap is Defender for App Service, which sounds adjacent but is scoped to App Service resources, and WAF, which is a preventive control rather than posture and detection.
Design solutions for security posture management in hybrid and multicloud environments
Halberd Finance suffered an incident in which a compromised service principal enumerated subscriptions with an offensive toolkit, disabled diagnostic settings, and then listed secrets from an Azure Key Vault named kv-treasury. The CISO requires detection of similar suspicious control-plane activity across all 20 subscriptions and of anomalous access patterns against every key vault. The design must be agentless and must not require changes to the applications that use the vaults.
Which combination of plans should you recommend?
- ADefender for Resource Manager and Defender for Key Vault on all 20 subscriptionsDefender for Resource Manager analyzes Azure Resource Manager operations for toolkit usage, suspicious management activity, and defense-evasion such as disabling logging, while Defender for Key Vault detects unusual secret access patterns; both are subscription-level, agentless plans.
- BDefender for Servers Plan 2 and Defender for Key Vault on all 20 subscriptionsDefender for Servers detects threats on machines; it does not analyze control-plane operations performed by a service principal through Azure Resource Manager.
- CDefender CSPM with attack path analysis and Microsoft Sentinel analytics rules on Key Vault diagnostic logsDefender CSPM is posture, not real-time threat detection, and relying on diagnostic logs fails when the attacker's first action is to disable those settings; it also adds detection engineering effort rather than a managed plan.
- DDefender for Resource Manager and Defender for Storage on all 20 subscriptionsDefender for Storage detects threats against storage accounts; it provides no coverage for Key Vault secret access anomalies.
Why: Two Defender for Cloud plans are specifically agentless, subscription-wide detections: Defender for Resource Manager watches the control plane for reconnaissance tools, privilege changes, and defense-evasion, and Defender for Key Vault learns normal access patterns per vault and alerts on anomalies. The deciding constraints are agentless operation and no application changes, which both plans meet because they consume platform telemetry. The trap is reaching for Sentinel rules on diagnostic logs, which depends on logging that the attacker already disabled, or for Defender for Servers, which cannot see service-principal activity that never touches a VM.