Fundamental
Prepare and test your skills
Fundamental
Prepare and test your skills
Defender for Cloud Posture Management and Threat Protection
Free sample question, answered and explained below. The AZ-900 Microsoft Azure Fundamentals Exam practice bank has 688 more like it. Try 10 free: instant score, no account.
An enterprise operates a hybrid cloud infrastructure with resources distributed across Microsoft Azure and on-premises datacenters. The security team needs a centralized security management solution that fulfills the following operational requirements:
- Continuously assess and strengthen the security posture across all hybrid and multicloud workloads
- Provide automated security recommendations to resolve misconfigurations and vulnerabilities
- Deliver real-time threat detection, intelligent alerting, and advanced threat protection
Which Azure solution should the enterprise implement to meet these requirements?
Explanations
Microsoft Purview
Microsoft Purview
What Microsoft Purview Is
Microsoft Purview is a comprehensive data governance, risk management, and compliance suite. It helps organizations discover, classify, govern, and protect sensitive structured, unstructured, and SaaS data across multi-cloud, on-premises, and software-as-a-service platforms.
Why It Does Not Meet the Requirement
Microsoft Purview specializes in data discovery, data lineage tracking, and information protection (such as sensitivity labels and encryption). It is not designed to assess general infrastructure health, monitor VM security posture, or provide real-time runtime threat detection for compute, networking, and container infrastructure.
Key Characteristics and Limitations
- Data Classification & Labeling: Automatically identifies sensitive information types (e.g., credit card numbers, PII) and applies encryption using the Azure Rights Management service.
- Data Catalog and Lineage: Maps and tracks data flows and schemas across hybrid data estates for governance and compliance audits.
- Data Loss Prevention (DLP): Prevents accidental or intentional exfiltration of sensitive files across endpoints, email, and cloud apps.
- Not an Infrastructure Defender: Lacks CWPP and CSPM capabilities required to monitor operating system vulnerabilities or analyze system-level attack vectors.
This Answer Would Be Correct If
The primary goal was to discover sensitive data across heterogeneous storage repositories, apply automated classification labels, and control information protection policies.
Azure Key Vault
Azure Key Vault
What Azure Key Vault Is
Azure Key Vault is a dedicated cloud service built to securely store, manage, and control access to sensitive organizational assets such as cryptographic keys, application secrets, connection strings, and X.509 certificates. It uses hardware security modules (HSMs) to protect confidential credentials against unauthorized exposure.
Why It Does Not Meet the Requirement
While essential for secrets management, Azure Key Vault does not offer unified security posture monitoring, automated workload vulnerability scanning, or threat detection capabilities. It serves as a secure storage repository rather than a broader security management and threat mitigation platform.
Key Characteristics and Limitations
- Secrets and Certificate Lifecycle: Automates the provisioning, rotation, and lifecycle management of TLS/SSL certificates and application API keys.
- Access Control via RBAC and Policies: Restricts access to cryptographic material based on fine-grained identity permissions.
- No Workload Assessment: Cannot evaluate resource configurations across hybrid datacenters or generate security posture scores.
- No Threat Detection: Does not detect malware, network intrusions, or active runtime threats targeting virtual machines or containers.
This Answer Would Be Correct If
The organization required a centralized, hardware-backed cloud solution to securely store database connection strings, manage API tokens, and automate SSL/TLS certificate renewals.
Microsoft Defender for Cloud
Microsoft Defender for Cloud
What Microsoft Defender for Cloud Is
Microsoft Defender for Cloud is a comprehensive cloud-native application protection platform (CNAPP) designed to enhance cybersecurity across hybrid and multicloud environments. It provides unified security posture management and integrated threat detection for workloads hosted in Azure, other major cloud providers (such as AWS and GCP), and on-premises datacenters.
How It Meets the Requirements
Microsoft Defender for Cloud satisfies all organizational criteria by delivering two fundamental pillars of cloud security:
- Cloud Security Posture Management (CSPM): It continuously evaluates resource configurations against established security baselines, generating a dynamic Secure Score alongside actionable remediation steps to harden systems against potential exploits.
- Cloud Workload Protection Platform (CWPP): Through dedicated Defender plans, it provides advanced, intelligent threat detection and real-time security alerting for virtual machines, containers, databases, storage accounts, and network layers across hybrid environments.
Key Advantages and Capabilities
- Unified Visibility: Delivers a single pane of glass for monitoring security compliance and vulnerabilities across on-premises and multicloud resources via Azure Arc.
- Continuous Assessment: Automatically discovers newly deployed assets and evaluates them against industry compliance benchmarks (e.g., CIS Benchmarks, NIST, ISO 27001).
- Prioritized Recommendations: Employs context-aware risk analysis to prioritize high-impact security findings, streamlining administrative remediation efforts.
- Integrated Threat Intelligence: Correlates vast global threat signals from Microsoft security research to detect zero-day threats, brute-force attempts, and anomalous behavior.
Why This Is Optimal
Unlike isolated governance or encryption tools, Microsoft Defender for Cloud combines holistic posture visibility with proactive, real-time threat defense, making it the definitive foundational security platform for modern enterprise workloads.
Azure Policy
Azure Policy
What Azure Policy Is
Azure Policy is a core governance service in Azure that allows organizations to define, enforce, and audit resource configurations to maintain organizational standards and regulatory compliance at scale throughout the resource lifecycle.
Why It Does Not Meet the Requirement
Although Azure Policy plays a significant role in enforcing configuration standards (and powers the underlying compliance checks within Defender for Cloud), it does not provide active workload threat detection, runtime malware scanning, behavioral anomaly alerts, or dedicated hybrid workload security protections.
Key Characteristics and Limitations
- Governance Enforcement: Evaluates declarative JSON policies to prevent the deployment of non-compliant resources (e.g., blocking unapproved VM sizes or missing tags).
- Remediation at Provisioning: Applies automated parameter adjustments during deployment using policy effects such as
ModifyorDeployIfNotExists. - Control Plane Focus: Operates primarily at the Azure Resource Manager (ARM) management layer rather than within the runtime workload environment.
- Absence of Real-Time Threat Alerts: Cannot analyze runtime operating system logs or network traffic to detect active adversary tactics.
This Answer Would Be Correct If
The enterprise needed to enforce strict governance rules that automatically audit and block the creation of public IP addresses or non-compliant virtual machines in specific regions.
Try 10 interactive questions like this one, free
Answer them yourself and get your score the moment you finish. No account needed.
Full access includes
- 688 practice questions across all 3 exam domains
- Every answer explained: why it is right, and why the others are not
- Scout, an AI tutor that answers your follow-up questions
- Readiness tracking by domain, so you know when to book the exam
Related questions
Keep the momentum going with these hand-picked practice scenarios
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Microsoft Defender for Cloud Regulatory Compliance Dashboard
Describe the purpose of Microsoft Defender for Cloud
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Microsoft Defender for Cloud Threat Detection
Describe the purpose of Microsoft Defender for Cloud
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Microsoft Defender for Cloud CSPM
Describe the purpose of Microsoft Defender for Cloud
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Microsoft Sentinel SIEM Integration
Describe the purpose of Microsoft Defender for Cloud
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Microsoft Defender for Cloud Security Posture Management
Describe infrastructure as a service (IaaS)
ExpertAZ-500 Microsoft Azure Security Technologies Exam
Application Permissions vs Delegated Permissions
Configure app registration permission scopes
Last updated Validated