A healthcare group runs hundreds of Windows and Linux servers in its own datacentre and in a third-party cloud, and the architect must design posture management so these non-Azure servers appear in Microsoft Defender for Cloud inventory, are scored by Secure Score, and can have a workload protection plan enabled on them as if they were Azure resources, while keeping a single consistent benchmark baseline across the whole hybrid estate. Which design sequence best satisfies this hybrid posture requirement?
- AOnboard each server to Azure Arc so it is projected as an Arc-enabled machine, then in Microsoft Defender for Cloud assess the estate against the Microsoft cloud security benchmark and enable the relevant workload protection plan on the Arc-enabled servers. Correct
- BEstablish ExpressRoute to the datacentre and the third-party cloud so the servers gain private reachability, after which Microsoft Defender for Cloud discovers them over the network and scores them against the Microsoft cloud security benchmark.
- CConfigure Azure Lighthouse delegated resource management across the datacentre and third-party cloud so Microsoft Defender for Cloud manages the servers cross-tenant and scores them against the Microsoft cloud security benchmark as Azure resources.
- DStream each server's configuration and event logs into Microsoft Sentinel and build analytics rules that compare the settings to the Microsoft cloud security benchmark, so the workspace becomes the hybrid posture and plan-enablement console.
Why A is correct: Azure Arc projects on-premises and other-cloud servers into Azure Resource Manager as Arc-enabled machines, which is precisely what lets Defender for Cloud inventory them, apply the benchmark, score them, and enable a plan such as Defender for Servers consistently.
Why B is wrong: Private connectivity is tempting as a hybrid enabler, but network reachability alone does not register the servers as Azure resources, so Defender for Cloud has nothing to inventory, score, or enable a plan against.
Why C is wrong: Lighthouse is appealing because it crosses management boundaries, but it delegates management of existing Azure resources across tenants and cannot project non-Azure physical or virtual servers into Azure for Defender for Cloud to govern.
Why D is wrong: Sentinel is tempting because it ingests logs from anywhere, but it is a SIEM for detection and investigation and neither registers servers as Azure resources nor enables per-resource workload protection plans against a benchmark.