You are a SOC Analyst for company XYZ that is deploying cloud workload protection with Azure Defender. Your work is to ensure Azure Defender automatically protects the Azure resources. Your organization has a small number of Azure virtual machines that are not part of the auto provisioning scheme. You must manually configure protection for these Azure resources. 
What feature should you configure on a new Azure Windows Virtual Machine if auto provisioning is not enabled?

Answer options:

A.Sysmon
B.Windows Firewall
C.Log Analytics Agent
D.Log collection Agent

Correct Answer: C Option C is correct. You need to install the Log Analytics Agent.
Option A and D is incorrect. Sysmon is not related to provisioning.
Option B is incorrect. Windows Firewall is already installed on a Windows VM
Reference: 

https://docs.microsoft.com/en-us/azure/security-center/azure-defender