You have a Microsoft 365 subscription E5 subscription. Your have the following servers: 
Domain Controller: Windows Server 2016 
SQL Server: Windows Server 2019 
Member Server: Windows Server 2016 
Considerations: No software should be installed on the Domain Controller. 
To protect your organization against threats you decide to deploy Microsoft Defender for Identity.How would you configure this?

Answer options:

A.Install ATP Sensor on your Domain Controller
B.Install ATP Sensor on the Member Server
C.Install ATP Standalone sensor on the Domain Controller
D.Install ATP Standalone sensor on the Member Server

Correct Answer: D 
Since we are not allowed to install the ATP Sensor on the domain controller directly, we must install the ATP Standalone sensor on the Member Server 
Configure port mirroring for the domain controller to be monitored
Recommendation: Set an event forwarding from the domain controller to get the Windows Event Logs
Option A is incorrect. We are not allowed to install anything on the domain controller.
Option B is incorrect. We must install the Standalone sensor to be able to send traffic through port mirroring.
 Option C is incorrect. We are not allowed to install anything on the domain controller.
Reference: 
To know more about defender for identity prerequisites, please refer to the link below: 

https://docs.microsoft.com/en-us/defender-for-identity/prerequisites