[References:, https://docs.microsoft.com/en-us/azure-advanced-threat-protection/atp-capacity-planning, , However, if the case study had required that the DCs can't have any s/w installed, then the answer would have been a standalone sensor on Server2. In this scenario, the given answer is correct. BTW, ATP now known as Defender for Identity., , , ]