Microsoft Defender for Cloud collects security-related event data from virtual machines (VMs) by connecting them to a Log Analytics workspace. To minimize both administrative overhead and cost, the most efficient configuration invol ves automatic provisioning and setting an appropriate data collection level .
* Automatic Provisioning (Option E): According to Microsoft Defender for Cloud documentation, enabling automatic provisioning ensures that the Log Analytics agent (also known as the Defender for Cloud agent) is automatically installed and configured on all existing and new Azure virtual machines.
This eliminates the need for manual agent deployment, significantly reducing administrative effort.
* Data Collection Level - Common (Option A): Defender for Cloud allows configuration of event collection levels - None , Common , and All Events .
* Common collects essential security events needed for threat detection, such as logon failures, account lockouts, and other critical activities, thereby r educing storage and processing costs.
* All Events collects all Windows security logs, increasing data volume and cost without necessarily improving detection for most environments.
By combining automatic provisioning with the "Common" event level, you ensur e coverage for Defender for Cloud's analytics with minimal manual configuration and optimized costs.
Therefore, the correct and verified answer is:
# A. Set data collection level to Common
# E. Enable automatic provisioning for the virtual machines