AZ-305 Practice Question 50: Hybrid Server Governance
Microsoft Azure Solutions Architect Expert (AZ-305) · Test 5 · question 10 of 10
An insurer runs 400 Windows and Linux servers: about 280 in its own datacenters and 120 on Amazon EC2. None of them can be migrated this year. The platform team wants to:
- see all 400 machines as resources in Azure, in resource groups, with tags and Azure RBAC, - audit operating system settings against a standard using Azure machine configuration, - onboard the machines to Microsoft Defender for Cloud and collect guest logs with the Azure Monitor Agent, - manage operating system updates for all of them from one place.
What should you include in the design?
Show answer and explanation
Answer:
Azure Arc-enabled servers manage Windows and Linux physical servers and virtual machines hosted outside Azure (on a corporate network or with another cloud provider) the same way you manage native Azure virtual machines. Connecting a machine with the Connected Machine agent gives it an Azure Resource ID, so it can live in a resource group alongside native resources and carry tags and role assignments. The documented supported operations cover the rest of the list: assigning Azure machine configurations to audit settings inside the machine, protecting non-Azure servers through Microsoft Defender for Cloud, collecting logs with the Azure Monitor Agent into a Log Analytics workspace, and using Azure Update Manager for operating system updates.
Option A answers a question nobody asked. The scenario states the servers cannot be migrated this year; a migration programme for 400 machines is a multi-quarter project and does nothing for the governance gap in the meantime.
Option C delivers only the monitoring slice. The agent ships logs and performance data, but the machines never become Azure resources, so there are no tags, no RBAC, no machine configuration auditing, no Defender for Cloud onboarding, and no update management.
Option D is narrower still. Syslog forwarding into Sentinel gives the security team events to analyze; it provides no resource representation, no configuration auditing, and no patching capability, and Sentinel is a SIEM, not a management plane for servers.
Reference: Azure Arc-enabled servers overview