Installing the Azure Connected Machine agent to onboard an AWS-hosted server to Defender for Cloud

SC-200 By islever Editorial Last updated

Short answer

C The Azure Connected Machine (Arc) agent connects the AWS-hosted server to Azure so Defender for Cloud can onboard it.

Question

You have an Azure subscription that has Microsoft Defender for Cloud enabled. You have a virtual machine named Server1 that runs Windows Server 2022 and is hosted in Amazon Web Services (AWS). You need to collect logs and resolve vulnerabilities for Server1 by using Defender for Cloud. What should you install first on Server1?
  1. the Microsoft Monitoring Agent
  2. the Azure Monitor agent
  3. the Azure Connected Machine agent Correct Answer
  4. the Azure Pipelines agent

Key Takeaways

Non-Azure machines (AWS, on-premises) must run the Azure Connected Machine agent (Arc agent) to be projected into Azure and managed by Defender for Cloud, including log collection and vulnerability assessment.

To collect logs and assess vulnerabilities for a Windows Server hosted in AWS using Defender for Cloud, you first install the Azure Connected Machine agent (Azure Arc agent), which connects the non-Azure machine to Azure so it can be onboarded.

Common mistake: Installing the Azure Monitor agent alone — AMA collects guest data but does not onboard a non-Azure machine to Azure; the Connected Machine (Arc) agent is the prerequisite connectivity layer.

Expert Analysis

Why the Answer Is Correct

Server1 runs in AWS, not Azure. To bring it under Microsoft Defender for Cloud for log collection and vulnerability assessment, you must first install the Azure Connected Machine agent (also called the Azure Arc agent), which connects the non-Azure machine to Azure and makes it manageable as an Arc-enabled server.

Why the Other Options Are Wrong

The Azure Monitor agent (B) collects monitoring data but requires the machine to already be connected to Azure via Arc. The legacy Microsoft Monitoring Agent (A) is deprecated and also assumes Azure connectivity. The Azure Pipelines agent (D) is for DevOps build/release, unrelated to Defender for Cloud onboarding.

Community Comment Notes

The community is unanimous (C 100). Polomint (8 likes), ServerBrain, and g_man_rap all confirm the Azure Connected Machine (Arc) agent is for non-Azure systems such as AWS, and that AMA alone does not onboard the machine.

Official Reference

https://learn.microsoft.com/en-us/azure/azure-arc/servers/agent-overview

This link opens the official vendor documentation in a new tab.

Community Votes

C
100%

100% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 7 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 7

  1. Polomint 👍 8 Answered C
    Correct answer is C: Azure Connected Machine Agent is ment for systems outside of Azure such as AWS. Azure Monitor Agent Azure Monitor Agent (AMA) collects monitoring data from the guest operating system of Azure and hybrid virtual machines.
  2. ServerBrain 👍 4 Answered C
    C. the Azure Connected Machine agent
  3. 1a144a0 👍 2 Answered C
    Connected machine agent = Azure arc agent
  4. g_man_rap 👍 1 Answered C
    The Azure Connected Machine agent (also known as the Azure Arc agent) is the correct choice. This agent allows non-Azure machines (like those in AWS, on-premises, etc.) to be connected to Azure and managed as part of Azure services. Once the machine is connected via this agent, it can be onboarded to Microsoft Defender for Cloud, enabling log collection, vulnerability assessment, and other security-related features.
  5. Studytime2023 👍 1
    C. the Azure Connected Machine agent The Azure Connected Machine agent is used to onboard non-Azure machines, including those hosted on other cloud platforms like AWS, to Azure for management and monitoring. Once the agent is installed, you can leverage Azure services, including Microsoft Defender for Cloud, to monitor and manage the machine, collect logs, and resolve vulnerabilities.
Show 2 more comments
  1. renrenren 👍 2 Answered C
    C is correct
  2. smanzana 👍 1
    Azure Connected Machine agent

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Creating a Microsoft Sentinel bookmark from the Hunting page to support an incident investigation

S-grade

Identifying Affected Entities in Microsoft Defender XDR Incidents

S-grade

Containing a Defender for Identity pass-the-ticket alert by quarantining only the affected device

S-grade

Limiting Microsoft Defender device discovery to specific onboarded devices by creating a device tag first

S-grade

Practice All SC-200 Questions

Access 80 questions with complete answers and detailed explanations.

View Full SC-200 Practice Test →

← Back to SC-200 Study Guide