Question

A retailer runs 400 Azure VMs across production and dev subscriptions. The security architect must design a posture solution that continuously assesses OS vulnerabilities and detects installed software risks without deploying or maintaining an agent on each VM, while keeping licensing cost minimal for the dev subscription that does not require runtime threat detection. Which design meets these requirements?

Accepted Answer

Enable Defender CSPM with agentless vulnerability scanning on both subscriptions and add Defender for Servers Plan 2 only where runtime protection is needed

Answer

Deploy the Microsoft Defender for Endpoint agent (via the Defender for Servers integration) to all 400 VMs and rely on its integrated vulnerability management

Answer

Enable Defender for Servers Plan 1 on both subscriptions, which provides agentless vulnerability assessment without any additional cost

Answer

Install the Qualys or Microsoft agent-based vulnerability assessment extension on all VMs and disable Defender CSPM to reduce cost