Specify requirements for securing server and client endpoints

Marrowgate Water operates three treatment plants whose control networks are fully air-gapped by regulation: no path to the internet or to Azure is permitted, even through a proxy. Each plant has an on-premises SIEM appliance that already receives syslog. The architect must evaluate a Microsoft Defender for IoT design that gives each plant OT asset inventory and threat detection and delivers alerts to the plant SIEM.

Which two requirements should you specify? Each correct answer presents part of the solution.

1. ADeploy OT network sensors in locally managed (air-gapped) mode at each plant, fed by SPAN or TAP trafficLocally managed sensors perform full inventory and detection on the appliance itself and operate with no connection to Azure, which is the only mode compatible with the air-gap rule.
2. BConfigure forwarding rules on each sensor to send alerts over syslog to the plant SIEM applianceSensor forwarding rules push alert data to local syslog, email, or partner systems directly from the sensor, so the plant SIEM receives detections without any cloud dependency.
3. CConnect the sensors to Azure through an outbound proxy and use the Defender for IoT data connector in Microsoft SentinelA proxy still establishes a path from the control network to Azure, which the regulation prohibits; the Sentinel connector requires cloud-connected sensors.
4. DDeploy Microsoft Defender for Endpoint to the plant engineering workstations and rely on device discovery for the controllersDevice discovery does not decode industrial protocols or detect OT-specific anomalies, and Defender for Endpoint needs cloud connectivity to report, which the air gap prevents.
5. EDeploy an on-premises management console to aggregate the three sensors centrallyThe legacy on-premises management console was retired in January 2025; sensors are now managed individually on the sensor console or from the Azure portal, so this component is not part of a current design.

Coldharbour Studios has 1,200 Windows 11 laptops that are joined to Microsoft Entra ID and managed by Intune; the company has no on-premises Active Directory. A penetration test found that every laptop shares the same built-in local administrator password. Security requires a unique, automatically rotated local administrator password per device that help desk staff can retrieve through a role-controlled interface, and the password must be rotated again after each use.

What should you recommend?

1. AEnable Windows LAPS in the Microsoft Entra device settings and deploy an Intune account protection policy that backs the password up to Microsoft Entra ID and enables post-authentication resetWindows LAPS is built into Windows 11, backs up a unique rotated password per device to Microsoft Entra ID for Entra-joined devices, lets authorized roles retrieve it from the Microsoft Entra admin center or Intune, and can reset it automatically after a configurable period following use.
2. BDeploy the legacy Microsoft LAPS MSI and Group Policy template to the laptopsLegacy LAPS stores passwords only in Active Directory Domain Services, which this company does not have, and it is superseded by the built-in Windows LAPS.
3. CUse an Intune PowerShell script to set a shared local administrator password stored in an Azure Key VaultA shared password reintroduces the lateral movement risk the penetration test flagged and provides no automatic rotation after use.
4. DAdd the help desk staff to the Microsoft Entra Joined Device Local Administrator roleThat role grants help desk accounts local administrator rights on all Entra-joined devices, which widens privilege rather than securing the built-in local account's password.

Ravelston Credit Union has 800 Windows 11 laptops managed by Microsoft Intune and 350 Windows Server machines, half in Azure and half on-premises and Arc-enabled. Auditors require documented, Microsoft-recommended hardening baselines for both populations, with drift reported centrally. The security team has two engineers and must minimize administrative effort; writing and maintaining custom settings catalogs is not acceptable.

What should you recommend?

1. AAssign the Intune Windows security baseline and Defender for Endpoint security baseline to the laptops, and assign the Azure Policy machine configuration initiative that audits Windows machines against the Azure compute security baseline to the Azure and Arc-enabled serversIntune ships Microsoft-maintained security baselines for Windows clients with per-setting compliance reporting, and Azure Policy machine configuration provides the Microsoft-maintained compute security baseline for both Azure VMs and Arc-enabled servers, so no custom catalogs are needed.
2. BEnroll the servers in Intune alongside the laptops and assign the Windows security baseline to both groupsWindows Server cannot be enrolled in Intune as a managed device, and Intune security baselines cannot target servers; Defender for Endpoint security settings management applies only endpoint security policies, not baseline profiles, to servers.
3. CBuild a custom settings catalog in Intune for the laptops and a custom Desired State Configuration package for the serversCustom catalogs and DSC packages give full control but must be authored and maintained by the team, which the scenario explicitly rules out.
4. DRely on the Defender for Cloud secure score for the servers and the Microsoft Secure Score for the laptops as the documented baselinesScores summarize posture but are not configuration baselines; they do not enforce or report individual hardening settings against a published standard.

Thornbury Chemicals operates a production plant where PLCs, HMIs, and engineering workstations communicate over Modbus and PROFINET. The OT engineering lead refuses any solution that installs software on controllers or injects traffic into the control network because a disruption could halt a batch. The CISO wants asset inventory, protocol-aware anomaly detection, and alerts forwarded to the SOC's Microsoft Sentinel workspace.

Which design should you recommend?

1. ADeploy Microsoft Defender for IoT OT network sensors that receive mirrored traffic from SPAN ports or network TAPs, connected to the cloud, with the Defender for IoT data connector in Microsoft SentinelOT sensors analyze a passive copy of network traffic, so they never touch controllers or send packets into the control network, and cloud-connected sensors stream alerts to Sentinel through the native connector.
2. BInstall Microsoft Defender for Endpoint on the PLCs and HMIs and enable device discoveryPLCs cannot run an endpoint agent, and even on HMIs Defender for Endpoint lacks industrial protocol analysis; active discovery also risks probing fragile controllers.
3. CRun an authenticated vulnerability scanner across the control network on a nightly scheduleActive scanning injects traffic into the OT network, which the engineering lead has ruled out because it can disrupt legacy controllers.
4. DEnable Enterprise IoT security in the Microsoft Defender portal to cover the plant devicesEnterprise IoT security relies on Defender for Endpoint devices on the same corporate segments and does not parse industrial protocols such as Modbus or PROFINET.