Question

A manufacturing company runs a segmented OT environment with legacy PLCs and SCADA systems on an isolated network that has no direct internet connectivity and cannot tolerate active scanning that could disrupt time-sensitive industrial processes. The security architect must design continuous asset discovery and threat detection for this OT network while forwarding alerts to the central Microsoft Sentinel workspace in Azure. Which design approach best meets these requirements?

Accepted Answer

Deploy Defender for IoT network sensors using SPAN/TAP passive traffic mirroring in the OT network, connect them to a local on-premises management console, and forward alerts through a controlled boundary to Sentinel

Answer

Install the Defender for Endpoint agent directly on each PLC and SCADA workstation to collect telemetry and stream it to Sentinel over the internet

Answer

Enable agentless Defender for IoT (enterprise IoT) integrated with Defender for Endpoint to actively probe the OT subnet and enumerate device inventory

Answer

Configure Azure Arc-enabled servers on the PLCs and apply Azure Policy machine configuration baselines to gather OT device posture