Fundamental
Prepare and test your skills
Fundamental
Prepare and test your skills
Microsoft Defender for Cloud Posture Protection and Remediation
Free sample question, answered and explained below. The AZ-900 Microsoft Azure Fundamentals Exam practice bank has 688 more like it. Try 10 free: instant score, no account.
An enterprise organization is designing a comprehensive defense-in-depth security strategy for its cloud workloads. The security team needs a solution that continuously evaluates their overall security posture, identifies misconfigurations and potential vulnerabilities across resources, and delivers proactive threat protection alerts alongside guided remediation steps.
Which Azure service should the organization implement to satisfy these requirements?
Explanations
Model Deployment Guardrails
Model Deployment Guardrails
What Model Deployment Guardrails Are and Do
Model Deployment Guardrails refer to specific content filtering and input/output control configurations applied to individual AI model deployments to filter harmful content and restrict inappropriate responses.
Why It Does Not Meet the Requirement
Guardrail settings are scoped to specific AI application endpoints and content filters. They do not monitor broad Azure infrastructure, evaluate overall security posture across subscriptions, or identify general misconfigurations and vulnerabilities across diverse cloud workloads.
Key Characteristics and Limitations
- Localized Scope: Operates only at the specific model or project application level.
- Content Filtering: Primarily prevents inappropriate user prompts and model completions rather than infrastructure threats.
- Manual or Policy-Linked: Requires manual inspection across projects or linkage to broader governance policies to identify gaps.
This Answer Would Be Correct If
The organization needed to configure specific content filtering rules to block objectionable content or adjust safety thresholds for generative AI endpoints.
Additional Context
While guardrails protect the Application Layer of AI systems, comprehensive defense-in-depth relies on centralized services like Microsoft Defender for Cloud to detect vulnerabilities across all layers.
Microsoft Defender for Cloud
Microsoft Defender for Cloud
What Microsoft Defender for Cloud Is
Microsoft Defender for Cloud is a cloud-native application protection platform (CNAPP) that combines Cloud Security Posture Management (CSPM) and Cloud Workload Protection (CWP). It serves as a foundational component in a defense-in-depth architecture by providing unified visibility and threat protection across cloud resources.
How It Meets the Security Requirements
- Continuous Posture Assessment: Defender for Cloud continuously evaluates Azure resources against established security benchmarks to represent the overall security posture of the environment.
- Vulnerability and Misconfiguration Detection: It automatically detects misconfigurations and potential vulnerabilities, flagging security posture gaps.
- Threat Protection Alerts: It provides real-time threat detection and security alerts for suspicious activities, such as user input prompt attacks or unauthorized access attempts.
- Remediation Recommendations: It delivers prioritized, actionable recommendations with direct links to resolve vulnerabilities in the Azure portal.
Key Advantages and Capabilities
- Centralized Security Dashboard: Offers a single-pane-of-glass view of your security posture across subscriptions and workloads.
- Multi-Layered Threat Detection: Analyzes telemetry across compute, storage, data, and AI workloads to pinpoint advanced threats.
- Built-in Compliance Standards: Assesses configurations against industry standards and regulatory compliance frameworks.
- Guided Remediation: Outlines explicit steps and quick-fix automation to resolve security gaps rapidly.
Why This Is Optimal
While other tools address specific areas like governance or data classification, Microsoft Defender for Cloud is specifically designed to assess security posture, detect real-world threats and vulnerabilities, and provide ongoing remediation guidance across multiple defensive layers.
Microsoft Purview
Microsoft Purview
What Microsoft Purview Is and Does
Microsoft Purview is a comprehensive data governance, risk, and compliance suite designed to help organizations discover, classify, protect, and manage sensitive data across on-premises, multi-cloud, and software-as-a-service (SaaS) environments.
Why It Does Not Meet the Requirement
Microsoft Purview focuses on data-level governance and data loss prevention rather than the overall infrastructure security posture or broad resource vulnerability management. It does not monitor general Azure resources for misconfigurations, nor does it deliver general cloud workload threat protection alerts.
Key Characteristics and Limitations
- Data Governance Focus: Specializes in sensitive information type (SIT) classification, eDiscovery, and data lifecycle management.
- Data Auditing: Provides auditing and compliance visibility for interactions with enterprise data and AI prompts/responses.
- Scope Boundary: Does not replace cloud-native threat protection for underlying infrastructure such as virtual machines or networks.
This Answer Would Be Correct If
The scenario required discovering sensitive data types, auditing data transactions, or enforcing data lifecycle retention and communication compliance rules.
Additional Context
In a complete defense-in-depth model, Microsoft Purview secures the Data Layer, while Microsoft Defender for Cloud protects the broader infrastructure, compute, and security posture layers.
Azure Policy
Azure Policy
What Azure Policy Is and Does
Azure Policy is a governance service that enables organizations to define, assign, and manage rules that enforce specific resource configurations and organizational standards at scale.
Why It Does Not Meet the Requirement
While Azure Policy is critical for enforcing rules (such as blocking public IP addresses or requiring resource tags), it is not a dedicated threat intelligence or vulnerability monitoring tool. It does not provide real-time threat protection alerts, detect active attacks, or evaluate workload runtime vulnerabilities.
Key Characteristics and Limitations
- Governance Enforcement: Primarily evaluates resource properties at deployment and during periodic compliance evaluation cycles.
- No Threat Detection: Lacks built-in mechanisms to alert administrators on real-time attack vectors like prompt attacks or brute-force logins.
- Configuration Focus: Focuses on resource creation rules rather than security telemetry analytics.
This Answer Would Be Correct If
The organization needed to enforce specific guardrails, such as preventing deployments in unapproved regions or automatically auditing configurations against organizational governance baselines.
Additional Context
Azure Policy frequently integrates with Microsoft Defender for Cloud by powering its underlying security initiatives, but policy enforcement alone does not replace threat detection and security posture monitoring.
Try 10 interactive questions like this one, free
Answer them yourself and get your score the moment you finish. No account needed.
Full access includes
- 688 practice questions across all 3 exam domains
- Every answer explained: why it is right, and why the others are not
- Scout, an AI tutor that answers your follow-up questions
- Readiness tracking by domain, so you know when to book the exam
Related questions
Keep the momentum going with these hand-picked practice scenarios
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Defense-in-Depth Perimeter Layer
Describe the purpose of the defense-in-depth model
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Defense-in-Depth Model
Describe the purpose of the defense-in-depth model
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Defense in Depth Layers
Describe the purpose of the defense-in-depth model
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Defense-in-Depth
Describe the purpose of the defense-in-depth model
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Advisor Recommendations
Describe the purpose of Azure Advisor
AdvancedAZ-104 Microsoft Azure Administrator Exam
Availability Zones High Availability
Deploy virtual machines to availability zones and availability sets
Last updated Validated