Question

A retail company runs Windows and Linux servers across on-premises datacenters, AWS EC2, and Azure VMs. The security architect must design a solution that (1) continuously assesses each server against a consistent security baseline, (2) reports compliance and configuration drift centrally in Microsoft Defender for Cloud, and (3) enables machine configuration policy enforcement regardless of where the server physically runs. Which foundational design decision best satisfies all three requirements?

Accepted Answer

Onboard all non-Azure servers with Azure Arc-enabled servers, then apply Azure Policy machine configuration and the Microsoft Cloud Security Benchmark through Defender for Cloud

Answer

Deploy Defender External Attack Surface Management (EASM) to discover the servers and generate baseline compliance findings for each host

Answer

Install the Microsoft Monitoring Agent (MMA) on each server and forward events to a Log Analytics workspace for manual baseline scoring

Answer

Enable Microsoft Defender for Endpoint on all servers and rely on device compliance policies in Microsoft Intune to enforce the baseline