Fundamental
Prepare and test your skills
Fundamental
Prepare and test your skills
Defender for Cloud VM Security Posture Management
Free sample question, answered and explained below. The AZ-900 Microsoft Azure Fundamentals Exam practice bank has 688 more like it. Try 10 free: instant score, no account.
An enterprise is deploying several Azure Virtual Machines (IaaS) to host a regulated business application. The security and compliance team requires a centralized service that continuously evaluates the virtual machines for missing critical security updates, operating system misconfigurations, disk encryption status, and alignment with industry compliance standards.
Which Azure service should the organization implement to meet these requirements?
Explanations
Microsoft Defender for Cloud
Microsoft Defender for Cloud
What Microsoft Defender for Cloud Is
Microsoft Defender for Cloud is a unified cloud-native application protection platform (CNAPP) and security posture management solution. It provides centralized visibility and control over the security posture of hybrid and cloud workloads across Azure subscriptions.
How It Meets the Requirements
Microsoft Defender for Cloud directly satisfies all compliance and security assessment requirements for Infrastructure as a Service (IaaS) virtual machines:
- Configuration Assessment: It continuously evaluates virtual machine operating system configurations against baseline security best practices and flags non-compliant settings.
- Vulnerability & Update Detection: It identifies missing system security updates, unpatched vulnerabilities, and missing endpoint protection software.
- Data Protection & Encryption: It validates the implementation of disk encryption to safeguard data at rest on virtual machine storage.
- Regulatory Compliance: It tracks workloads against recognized regulatory frameworks and industry benchmarks, delivering actionable recommendations to remediate compliance drift.
Key Advantages and Capabilities
- Continuous Security Assessment: Automatically discovers unmanaged resources and evaluates them against defined security policies.
- Role-Based Governance: Integrates seamlessly with Azure role-based access control (Azure RBAC) to ensure that security reports and insights are accessible only to authorized administrators.
- Integrated Threat Protection: Uses intelligent analytics and monitoring agents to detect active attacks and anomalous behavior targeting virtual machines.
- Centralized Dashboard: Consolidates alerts, recommendations, and compliance scores into a single administrative pane.
Why This Is Optimal
While other tools specialize in individual administrative tasks such as patching or raw telemetry collection, Microsoft Defender for Cloud provides the complete end-to-end security posture evaluation, regulatory compliance benchmarking, and vulnerability detection needed for Azure IaaS workloads.
Azure Update Manager
Azure Update Manager
What Azure Update Manager Is
Azure Update Manager is a management tool that helps automate, manage, and schedule software updates and operating system patching across Windows and Linux virtual machines in Azure and hybrid environments.
Why It Doesn't Meet the Requirement
Although Azure Update Manager is essential for maintaining software integrity and applying security patches, its capabilities are limited to update management:
- It does not evaluate virtual machine disk encryption status.
- It does not assess endpoint security protections or monitor for active network-based attacks.
- It does not provide holistic regulatory compliance evaluations across multiple security domains.
Key Characteristics and Limitations
- Dedicated Update Orchestration: Schedules and applies operating system updates during defined maintenance windows.
- Patch Compliance Reporting: Reports specifically on whether virtual machines have pending or missing operating system patches.
- No Threat Detection: Does not analyze runtime system behavior or scan for malicious activity.
This Answer Would Be Correct If
The requirement was strictly focused on scheduling operating system update deployment windows and reporting solely on missing software patches without requiring broader security configuration or disk encryption validation.
Additional Context
Azure Update Manager serves as an operational execution tool to remediate patch-related findings identified during broader Microsoft Defender for Cloud security posture assessments.
Azure Monitor
Azure Monitor
What Azure Monitor Is
Azure Monitor is a comprehensive platform service designed to collect, analyze, and act on telemetry and performance data from cloud and on-premises environments. It enables administrators to maximize the availability and performance of applications and infrastructure.
Why It Doesn't Meet the Requirement
While Azure Monitor collects operational telemetry, performance metrics, and diagnostic logs from virtual machines, it does not inherently provide automated security compliance assessments or vulnerability evaluations:
- It lacks built-in security posture scoring and regulatory compliance mapping.
- It does not automatically analyze operating system configurations against industry hardening benchmarks.
- It does not validate disk encryption policies or identify missing endpoint protection solutions natively.
Key Characteristics and Limitations
- Focus on Operational Health: Primarily measures metrics such as CPU utilization, memory consumption, disk I/O, and network throughput.
- Log Aggregation: Collects resource diagnostic logs and subscription activity logs for custom query analysis.
- Reactive Alerting: Triggers alerts based on performance thresholds or diagnostic log queries rather than proactive security misconfiguration scanning.
This Answer Would Be Correct If
The organization needed a service to monitor virtual machine performance metrics, track operational resource throughput, configure performance auto-scaling, or centralize diagnostic log collection.
Additional Context
Azure Monitor often works alongside security tools by providing the underlying Log Analytics workspace infrastructure where security agents store collected log telemetry.
Microsoft Entra Domain Services
Microsoft Entra Domain Services
What Microsoft Entra Domain Services Is
Microsoft Entra Domain Services provides managed domain services such as domain join, group policy, Lightweight Directory Access Protocol (LDAP), and Kerberos/NTLM authentication without requiring organizations to deploy and manage traditional domain controllers.
Why It Doesn't Meet the Requirement
Microsoft Entra Domain Services is strictly an identity and access management solution. It does not provide security posture assessments or compliance scanning:
- It does not scan virtual machines for operating system vulnerabilities or missing patches.
- It cannot audit disk encryption configuration or validate antimalware installation.
- It does not map infrastructure configurations against regulatory compliance standards.
Key Characteristics and Limitations
- Identity Management: Facilitates legacy protocol authentication for legacy applications running on Azure virtual machines.
- Managed Infrastructure: Delivers Active Directory features as a fully managed PaaS offering without virtual machine domain controller maintenance.
- No Posture Analytics: Does not generate security recommendations or detect network intrusions.
This Answer Would Be Correct If
The scenario required joining Azure virtual machines to an Active Directory domain and utilizing Kerberos authentication or Group Policy Objects without maintaining dedicated Windows Server domain controllers.
Additional Context
Identity management through Microsoft Entra services provides authentication controls that protect access to IaaS resources, but it must be paired with security posture management tools to evaluate overall virtual machine compliance.
Try 10 interactive questions like this one, free
Answer them yourself and get your score the moment you finish. No account needed.
Full access includes
- 688 practice questions across all 3 exam domains
- Every answer explained: why it is right, and why the others are not
- Scout, an AI tutor that answers your follow-up questions
- Readiness tracking by domain, so you know when to book the exam
Related questions
Keep the momentum going with these hand-picked practice scenarios
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
IaaS Scalability Control and Cost-Efficiency
Describe infrastructure as a service (IaaS)
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Infrastructure as a Service
Describe infrastructure as a service (IaaS)
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure IaaS Core Components
Describe infrastructure as a service (IaaS)
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
IaaS OS Administrative Control
Describe infrastructure as a service (IaaS)
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Resource Tags for Cost Allocation
Describe the purpose of tags
IntermediateAZ-800 Administering Windows Server Hybrid Core Infrastructure Exam
Azure File Sync Event Logs and Azure Monitor
Configure and manage Azure File Sync
Last updated Validated