Question

A manufacturer builds smart building controllers that run a lightweight embedded Linux OS and communicate with an Azure IoT Hub over MQTT. The security architect must specify requirements so that each device reports its own security telemetry (open ports, baseline drift, suspicious processes) directly to the cloud, and so that firmware components with known CVEs are surfaced. The controllers have enough compute to run a small agent. Which approach best meets these requirements?

Accepted Answer

Deploy the Microsoft Defender for IoT micro-agent onto the devices and integrate firmware analysis with Defender for IoT's firmware scanning capability

Answer

Deploy a Defender for IoT network sensor in passive (SPAN) mode on the building network and rely solely on traffic mirroring for per-device telemetry

Answer

Enroll the controllers in Microsoft Intune as mobile devices and apply endpoint compliance policies to collect the security telemetry

Answer

Onboard each controller with Azure Arc-enabled servers and enable the Defender for Servers plan to collect OS baseline and process telemetry