SC-200 Certification Practice Question #85

Question

You have an Azure subscription that uses Microsoft Defender for Cloud.

You have an Amazon Web Services (AWS) account that contains an Amazon Elastic Compute Cloud (EC2) instance named EC2-1.

You need to onboard EC2-1 to Defender for Cloud.

What should you install on EC2-1?

Accepted Answer

Onboarding a non-Azure machine (an AWS EC2 instance) to Defender for Cloud requires first projecting it into Azure as an Azure Arc-enabled server, which is done by installing the Azure Connected Machine agent — MS Learn states Defender for Servers on AWS requires "Azure Arc for servers installed on your EC2 instances." The Log Analytics agent (option A) and the Microsoft Monitoring Agent (option D) are the same legacy agent and were retired in August 2024; they also cannot onboard a machine that does not yet exist in Azure. Option C (unified Defender for Endpoint package) is a valid alternative path in some scenarios but presupposes a Defender for Endpoint/M365 entitlement the question never grants. Both the Suggested Answer and the strongly upvoted community consensus land on B; confidence is held at 88 rather than higher because a vocal minority argued A under older guidance.

More SC-200 practice questions