Fundamental
Prepare and test your skills
Fundamental
Prepare and test your skills
Azure Advisor Security Recommendations for Stronger Protection
Free sample question, answered and explained below. The AZ-900 Microsoft Azure Fundamentals Exam practice bank has 688 more like it. Try 10 free: instant score, no account.
An IT team manages an environment with multiple virtual machines, storage accounts, and cloud databases in Azure. The team wants to review personalized, actionable recommendations to improve their overall security posture, enable recommended security features, and remediate potential vulnerabilities across their deployed workloads.
Which Azure service provides these personalized security recommendations?
Explanations
Azure Cost Management
Azure Cost Management
What Azure Cost Management is and does
Microsoft Cost Management is a suite of tools designed to help organizations monitor, allocate, analyze, and budget their cloud spending across subscriptions and resource groups.
Why it doesn't meet the requirement
Azure Cost Management focuses strictly on financial tracking, cost visualization, forecasting, and budgets. It does not evaluate system security configurations, identify potential resource vulnerabilities, or suggest security best practices.
Key characteristics and limitations
- Spending Analysis: Provides customizable cost analysis charts and reports based on tags, resource types, and billing periods.
- Budget Alerts: Triggers alerts when actual or forecasted spending exceeds predefined organizational thresholds.
- Financial Scopes: Operates at billing account, enrollment, subscription, and resource group levels.
This answer would be correct if
The scenario asked how to create budget alerts, analyze monthly resource billing trends, or track cloud spending across departments.
Additional context
While Azure Advisor has a dedicated Cost pillar that recommends cost-saving measures (such as right-sizing underutilized virtual machines), security posture assessments fall outside the purpose of cost management tools.
Azure Advisor
Azure Advisor
What Azure Advisor is
Azure Advisor is a personalized cloud consultant that analyzes resource configurations and usage telemetry to provide proactive, actionable best practice recommendations. It evaluates your cloud environment against the core pillars of the Microsoft Azure Well-Architected Framework: Security, Cost, Reliability, Operational Excellence, and Performance.
How it meets the security requirement
Azure Advisor integrates directly with built-in security intelligence to identify vulnerabilities, misconfigurations, and missing security controls across your Azure subscriptions. Under the Security pillar, it provides specific suggestions such as:
- Enabling endpoint protection on virtual machines.
- Applying storage encryption and restricting public network access.
- Enforcing multi-factor authentication (MFA) for administrative accounts.
- Remedying insecure configurations and open management ports.
Key advantages and capabilities
- Unified Dashboard: Offers a centralized location to view, prioritize, and triage recommendations across multiple subscriptions.
- Customizable Alerts: Allows administrators to configure notification digests and alerts when new critical recommendations appear.
- Actionable Remediation: Provides step-by-step guidance and quick-fix remediation options directly within the Azure portal.
- Recommendation Lifecycle Management: Enables teams to postpone, dismiss, or assign recommendations to specific teams for review.
Why this is optimal
Azure Advisor is the optimal solution because it provides personalized, holistic guidance natively at no additional cost, allowing organizations to continuously monitor and improve their overall security posture.
Azure Monitor
Azure Monitor
What Azure Monitor is and does
Azure Monitor is a comprehensive telemetry collection and observability platform that collects, analyzes, and acts on telemetry data from cloud and on-premises environments.
Why it doesn't meet the requirement
Azure Monitor collects metrics and logs to track application performance, system health, and diagnostic data. While it can trigger alerts based on metric thresholds or log search queries, it is not an advisory service designed to evaluate architecture against security best practice pillars or provide vulnerability remediation suggestions.
Key characteristics and limitations
- Telemetry Ingestion: Gathers performance metrics and event logs from Azure resources, operating systems, and applications.
- Visualization Tools: Powers workbooks, dashboards, and integrations with Log Analytics and Application Insights.
- Metric Alerting: Sends notifications or runs automated actions when specific operational thresholds (e.g., CPU utilization > 90%) are breached.
This answer would be correct if
The scenario required setting up real-time performance alerts, capturing application crash logs, or visualizing virtual machine CPU and memory utilization.
Additional context
Telemetry collected by Azure Monitor can be used by advisory services to help generate recommendations, but the service that provides personalized best practice recommendations is Azure Advisor.
Azure Policy
Azure Policy
What Azure Policy is and does
Azure Policy is a governance service that enables organizations to define, assign, and enforce business rules and compliance standards across cloud resources through declarative policy definitions.
Why it doesn't meet the requirement
While Azure Policy helps evaluate compliance and can audit or enforce specific security configurations (such as blocking public IP creation), it is primarily an enforcement and governance engine rather than a personalized advisory service. It does not automatically analyze telemetry to suggest general architectural optimization recommendations across pillars.
Key characteristics and limitations
- Rule Enforcement: Evaluates properties at deployment time and during background compliance scans to
Deny,Audit, orModifyresource properties. - Policy Assignment: Applies policies at management group, subscription, or resource group scopes.
- Manual Definition: Requires policy initiatives to be assigned and configured rather than automatically generating personalized best practice suggestions.
This answer would be correct if
The scenario required preventing developers from deploying virtual machines without managed disks or automatically blocking deployments that do not conform to corporate compliance standards.
Additional context
Azure Policy works alongside Azure Advisor and security services; Advisor may surface recommendations highlighting resources that are out of compliance with established security baselines.
Try 10 interactive questions like this one, free
Answer them yourself and get your score the moment you finish. No account needed.
Full access includes
- 688 practice questions across all 3 exam domains
- Every answer explained: why it is right, and why the others are not
- Scout, an AI tutor that answers your follow-up questions
- Readiness tracking by domain, so you know when to book the exam
Related questions
Keep the momentum going with these hand-picked practice scenarios
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Advisor Recommendations
Describe the purpose of Azure Advisor
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Advisor Operational Excellence Category
Describe the purpose of Azure Advisor
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Advisor Cost Optimization
Describe the purpose of Azure Advisor
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Advisor Recommendations
Describe the purpose of Azure Advisor
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Shared Responsibility Model Physical Security
Describe the shared responsibility model
IntermediateAZ-400 Designing and Implementing Microsoft DevOps Solutions Exam
GitHub Branch Protection Rules and SAML SSO
Design and implement permissions and roles in GitHub
Last updated Validated