SC-100 Certification Practice Question #54

Question

You have an Azure subscription that has Microsoft Defender for Cloud enabled.
You have an Amazon Web Services (AWS) implementation.
You plan to extend the Azure security strategy to the AWS implementation. The solution will NOT use Azure Arc.
Which three services can you use to provide security for the AWS resources? Each correct answer presents a complete solution.
NOTE: Each correct selection is worth one point.

Accepted Answer

The constraint "the solution will NOT use Azure Arc" is the discriminator. MS Learn's CWPP dependency table lists the Azure Arc agent as **required** for Defender for Servers, so B is eliminated — this kills the ABE answer. Defender for Containers onboards AWS EKS without Arc (agentless discovery / Kubernetes API access), so A stays. Conditional Access (C) operates through Entra ID / AWS SSO federation, independent of Arc. Azure Policy (E) is valid because Defender for Cloud's AWS connector assesses AWS resources against the Microsoft Cloud Security Benchmark agentlessly — only Azure Policy *for Kubernetes* needs the Arc extension, which is not what option E broadly requires. This makes ACE consistent with both the official Suggested Answer (E confirmed valid) and the dominant 46-vote community pick. Confidence is held at 78 because there is a genuine, well-reasoned ACD vs ACE community split over whether Azure Policy can touch AWS without Arc; ACE wins on the official Suggested letter (E), the largest vote bloc, and the top comment, but the dissent is substantive enough to lower certainty.

More SC-100 practice questions